On New Year's eve, the British currency exchange company Travelex was hacked, with hackers demanding a six-figure ransom in bitcoin

Just before New Year's eve 2020, when everyone was already in holiday mode and the family was gathering to celebrate the arrival of the New Year, a hacker group was set out in the dark.

This time, instead of targeting cryptocurrency trading platforms or wealthy executives, the hackers are targeting u.k.-based currency exchange company Travelex. Travelex has nearly 1,200 offices in more than 30 countries around the world,

The timing was perfect, as many of the company's employees were already away on holiday celebrating the New Year. The inevitable "hole" was exploited.

The attack quickly ended, and a number of Travelex platforms were affected, including stores in France, Japan and Germany.

To protect data and prevent further spread of malware, companies have to take their systems offline. But to minimize the negative impact, the company began hiding the attack under the pretext of "planned maintenance."

A few days later, the company's headquarters website is still offline, and users will see a "server error" whenever they log in. Travelex said in a tweet that it was unable to trade on its website or through its app. Some stores are said to be forced to handle requests manually.

Companies that rely on Travelex's payment capabilities, such as Tesco Bank, went down.

Then the hacker showed up and, unsurprisingly, demanded a ransom.

According to ComputerWeekly, the hackers demanded a six-figure sum to provide Travelex with a decryption tool. In other words, Travelex must pay a ransom to recover the contents of files encrypted by the virus on its computer network.

"This is just business. We don't Care about you and the details. This is just the way we want you to cooperate." "The hacker threatened in a document. According to the disclosure, the hackers instructed Travelex's staff to use the secure Tor browser to access a site (which appears to be located at a data center in Colorado, us), and to unlock the files, they had to follow a prompt to enter a password that would eventually allow them to pay in bitcoins nearby.

According to the screenshots provided by the source, there are three ways to buy bitcoin on the website, including familiar websites such as Coinbase, cex.io, Huobi and LocalBitcoins. In addition, the prompt website also mentioned that the company must pay about 3.2 bitcoins to the designated address and wait for confirmation of at least three blocks.

Another hacking attempt to demand a ransom for bitcoin.

According to the latest report, Travelex is currently scrambling to recover the affected systems, but "declined to say whether a ransom will be paid".

However, analysts at security companies say that once a ransomware notice is received, it is difficult to recover the data, even if a ransom is paid, because hackers may delete logs to cover their tracks or even develop other ways to access the network.

On Jan. 7, Travelex posted an update on the incident on its website, saying, "Travelex has been able to restore many of its internal systems to normal operation, and the company is working to restore normal operations as soon as possible."

The latest official announcement: https://www.travelex.com/

Related articles:

https://www.bbc.com/news/business-51017852

https://www.computerweekly.com/news/252476283/Cyber-gangsters-demand-payment-from-Travelex-after-Sodinokibi-attack

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia