Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 23-Jan-2024 00:44:22 JST Kevin Beaumont

   Tietievry (24k employees, MSP) are dealing with an Akira ransomware incident on their Swedish services https://www.tietoevry.com/en/newsroom/all-news-and-releases/other-news/2024/01/update-on-ransomware-attack-in-sweden-restoration-work-progressing-at-tietoevry/

   They were prior hit by ransomware in 2021 with some of their Norwegian customers https://www.tietoevry.com/en/newsroom/all-news-and-releases/other-news/2021/02/information-about-ransomware-attack-in-norway/

   #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 01-Feb-2024 02:17:45 JST Kevin Beaumont

     in reply to

     Almost two weeks after being hit with ransomware in their Swedish datacenter, Tietoevry are still recovering customer services. https://www.tietoevry.com/en/newsroom/all-news-and-releases/press-releases/2024/01/tietoevry-solid-progress-with-restoration-of-customer-systems-after-the-ransomware-attack/

   • Embed this notice
     maswan (maswan@mastodon.acc.sunet.se)'s status on Thursday, 01-Feb-2024 03:47:50 JST maswan

     in reply to

     @GossiTheDog
     Regional hospital update: Supply of consumables solved, still struggling without the discharge IT system which is still down.

     Especially complicated for patients that get discharged to other long term care, 8-10 phone calls per patient instead of some form entries and maybe one or two phone calls.

     There is also fear, but nothing confirmed yet, that the patient records in this system might be in the wrong hands.

     Source: local press

   • Embed this notice
     Pär Björklund (paxxi@hachyderm.io)'s status on Thursday, 01-Feb-2024 07:06:00 JST Pär Björklund

     in reply to

     @GossiTheDog went to granngarden.se physical store Saturday and their inventory systems were still down

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 15-Feb-2024 03:10:29 JST Kevin Beaumont

     in reply to

     Tietoevry are still trying to recover from ransomware over a month in. Some customers who paid for managed backups have no backups, apparently.

     I’m quite confused by their statement they don’t know initial access point - they run Cisco AnyConnect VPN in that data centre and probably want to check their access logs.
     https://mastodon.acc.sunet.se/@maswan/111931139599220350

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 15-Feb-2024 05:46:38 JST Kevin Beaumont

     in reply to

     A reminder that, when it comes down to it, your cloud provider would rather throw you to the wolves than admit mistakes. https://www.dn.se/sverige/20-ar-av-data-borta-hackarna-kom-at-sakerhetskopior/