Ransomware Gang in Trading Hack Says Ransom Was Paid

February 3, 2023 – Published on Bloomberg

The hacking group behind the attack on ION Trading UK — the software firm that was struck by a cyberattack earlier this week, upending derivatives trading around the world — says a ransom has been paid.

The announcement came a day before the group, called LockBit, threatened to release stolen files from ION unless the extortion payment was made. An ION representative declined to comment.

A representative for the group told Bloomberg News that the ransom was paid and that the gang provided a decryption key to unlock the compromised computers.

Earlier Friday, the timer that LockBit had posted on its website, counting down to a Feb. 4 deadline by which it was demanding ransom from Ion, had been “stopped,” the site showed. The FBI declined to comment about LockBit’s claim that the ransom was paid.

Drew Schmitt, principal threat intelligence analyst at GuidePoint Security, said many hackers go through “levels of pressure” with victim organizations.“In many circumstances, there are the initial conversations where they prove they have your data, and then threaten to post it to their leak site,” he said. “Before fully posting the victim’s data to the leak site, they will first post their name only. In this circumstance, if the client then paid the ransom payment, their name would be removed from the site and nothing further would likely be posted.“Similarly, if the name and data were posted and then the ransom was paid, their name and information would be removed from the site,” Schmitt said. 

Read More HERE.