Administrador de Infraestructuras Ferroviarias (ADIF), a Spanish state-owned railway infrastructure manager was hit by REVil ransomware operators.
ADIF (Administrador de Infraestructuras Ferroviarias) is charged with the management of most of Spain’s railway infrastructure, that is the track, signaling and stations. It was formed in 2005 in response to European Union requirements to separate the natural monopoly of infrastructure management from the competitive operations of running train services.
The company has over 13,000 employees for a revenue of around $8 Billion.
The hackers claimed to have stolen 800GB of data including correspondence and contracts.
The incident was confirmed by Spanish media and security firms, including threat intelligence company Cyble.
As proof of the attack, REVil ransomware operators have posted a sample of data files exfiltrated from the company. If ADIF will refuse to pay the ransom, REvil ransomware operators will leak their confidential data online.
“Simultaneously with the publication, the third attack will follow,” the reads a message posted on their leak site. “We will continue to download your data until you contact us.”
Adif confirmed to IRJ that it has suffered a ransomware attack and added that its internal security services immediately mitigated it.
“The infrastructure has not been affected at any time, and the correct functioning of all its services has been guaranteed,” the company says. “Adif, aware of being the manager of a critical infrastructure such as the exploitation of the railway network, considers cybersecurity as one of the pillars of comprehensive security.”
“As per Cyble Research Team, the operators may have downloaded, what seems to be the company’s confidential data such as ADIF’s high-speed hiring committee contracts, property records, field works reports, project action plans, documents about customers, and much more.” reads the post published by Cyble.
Below one of the sample data leaked by the threat actors:
This week REVil ransomware operators also hit Telecom Argentina, one of the largest internet service providers in Argentina, infecting roughly 18,000 computers during the weekend and now are asking for a $7.5 million ransom.
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, ADIF)
[adrotate banner=”5″]
[adrotate banner=”13″]
Atrium Health disclosed a data breach affecting 585,000 individuals to the HHS, potentially linked to…
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CyberPanel flaw to its Known Exploited Vulnerabilities catalog.…
A bootloader vulnerability in Cisco NX-OS affects 100+ switches, allowing attackers to bypass image signature…
SOC analysts, vital to cybersecurity, face burnout due to exhausting workloads, risking their well-being and…
Operation Destabilise: The U.K. National Crime Agency disrupted Russian money laundering networks tied to organized…
Russia-linked APT group Secret Blizzard has used the tools and infrastructure of at least 6…
This website uses cookies.