UK rail network Merseyrail, which operates rail services across Merseyside, announced it was a victim of a cyber attack. A ransomware gang has also compromised the email system of the organization to inform employees and journalists about the attack.
The news was reported by BleepingComputer who received an email earlier from the account of Andy Heath, the Director of Merseyrail that also speculate. The email has the subject, “Lockbit Ransomware Attack and Data Theft,” for this reason BleepingComputer speculates the involvement of the Lockbit ransomware in the security incident.
“We can confirm that Merseyrail was recently subject to a cyber-attack. A full investigation has been launched and is continuing. In the meantime, we have notified the relevant authorities,” Merseyrail told BleepingComputer. “It would be inappropriate for us to comment further while the investigation is underway,”
The same email was sent to several UK newspapers, and to the Merseyrail employees, likely to make pressure on the organization to pay the ransom. It seems that the Lockbit Ransomware gang managed to compromise the Director’s @merseyrail.org Office 365 email account to inform the employees of the incident that was downplayed by the internal staff. The message includes a link to an image showing an employee’s personal information as proof of the attack.
The attackers claim to have stolen employee and customer data before encrypting the systems of the company.
UK rail network Merseyrail reported the incident to the UK authorities, including the Information Commissioner’s Office (ICO), and is investigating the incident with the help of law enforcement.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Merseyrail)
[adrotate banner=”5″]
[adrotate banner=”13″]
BlackBerry reported that the financially motivated group FIN7 targeted the IT department of a large…
An international law enforcement operation led to the disruption of the prominent phishing-as-a-service platform LabHost.…
Russia-linked APT Sandworm employed a previously undocumented backdoor called Kapeka in attacks against Eastern Europe since…
Cisco has addressed a high-severity vulnerability in its Integrated Management Controller (IMC) for which publicly…
Threat actors are exploiting the CVE-2023-22518 flaw in Atlassian servers to deploy a Linux variant of…
Ivanti addressed two critical vulnerabilities in its Avalanche mobile device management (MDM) solution, that can…
This website uses cookies.