IT services major <keyword id="28721" type="CITY" weightage="20" keywordseo="Cognizant">Cognizant</keyword> said it has become a victim of the 'Maze' ransomware attack that has caused disruptions to some of its clients.The company, which has about 2 lakh employees based in India, said it is in ongoing communication with clients and has provided them with indicators of compromise (IOCs) and other technical information of a defensive nature. "Cognizant can confirm that a security incident involving our internal systems, and causing service disruptions for some of our clients, is the result of a Maze ransomware attack," Cognizant said in a statement. It added that its internal security teams, supplemented by leading cyber defense firms, are actively taking steps to contain this incident. A ransomware typically logs users out of their own systems through forced encryption of data and asks them to pay a ransom if they want to access the encrypted data. "Cognizant has also engaged with the appropriate law enforcement authorities," the statement noted. The incident comes at a time when businesses have been disrupted by coronavirus pandemic that has forced companies to turn to initiatives like work from home to ensure business continuity. This has also led to concerns around security of data. "Based on present information, we don't believe the reaction to the COVID-19 pandemic or Cognizant's efforts to enable associates to work from home facilitated this incident," a Cognizant spokesperson said. See also: <a href="https://www.businessinsider.in/tech/enterprise/news/ransomware-attacks-are-causing-panic-and-chaos-at-overwhelmed-hospitals-struggling-with-covid-19-and-it-may-be-about-to-get-worse/articleshow/74853955.cms">Ransomware attacks are causing panic and chaos at overwhelmed hospitals struggling with COVID-19, and it may be about to get worse</a> <a href="https://www.businessinsider.in/careers/news/capgemini-india-cognizant-and-others-who-are-giving-salary-hikes-in-times-of-coronavirus/articleshow/75151960.cms">Capgemini India, Cognizant and others who are giving salary hikes in times of Coronavirus</a>

Cognizant hit by Maze ransomware, service disrupted for some clients

<ul><li>Cognizant first-quarter earnings were in the green but worst is yet to come with the full impact of the ransomware attack on its systems to be reflected in the coming quarters.</li><li>Management explained that there are multiple costs — including legal and consulting — associated with the investigation. </li><li>Even now, Cognizant expects that it will take at least until the end of the month to completely restore its systems.</li></ul>Cognizant’s first-quarter earnings were in the green, up by 3.5% in constant currency terms, but the shadow of the Maze ransomware attack on the company’s network still looms large. “We do anticipate the revenue and corresponding margin impact to be in the range of $50 to $70 million for the quarter [Q2],” said Cognizant’s Chief Financial Officer (CFO) Karen McLoughlin during the earnings call. <div type="Article" hostid="261" msid="75616476" title="Cognizant CEO Brian Humphries warns of a tough 2020— plans to hire 20,000 freshers this year" mstype="2" mssubtype="0"></div> “With the ransomware attack now contained… We are now substantially work from enabled,” added CEO Brian Humphries explaining that the vast majority of revenue impact will only be reflected in the next quarter’s earnings and continue to bear down in the coming year. “[The] ongoing remediation cost will institute through subsequent quarters,” he said. The issue with ransomware attacks, in comparison to other malware, is that the impact goes beyond mere monetary compensation. The company’s reputation takes a hit, clients back out and there’s a huge opportunity cost while security experts try to get systems back online. “We expect to incur certain legal, consulting and other costs associated with the investigation, service restoration and remediation of the breach,” explained McLoughlin. It’s going to take till the end of the month for Cognizant to completely get its systems back online and fully functional, according to Humphries. The ripple effects of a ransomware attack Cognizant isn’t the only company to get hit by Maze ransomware. The malicious software has been blamed for extorting a number of large organisations in the past year. However, the attack on Cognizant is likely the most prolific till date. “Unlike its predecessors, the group behind Maze ransomware delivered on its promises in late 2019 — more than once,” said global cybersecurity company Kaspersky. For instance, in November, when Allied Universal refused to pay up, the criminals <a href="https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/">leaked 700MB of internal data online</a> including contracts, termination agreements, digital certificates, and more. The blackmailers said they had published just 10% of what they had stolen and threatened to make the rest available publicly if the target did not cooperate. <div type="Article" hostid="261" msid="75271532" title="Cognizant's ransomware attack is making peers like TCS and Infosys nervous — and they are beefing up security" mstype="2" mssubtype="0"></div> For an IT services company like Cognizant, there’s a ripple effect that goes beyond simply paying the ransom. In addition to locking the company’s files behind a bitcoin paywall — sensitive information was stolen like targets for mergers and acquisitions, profit and loss reports, as well as medical records. “Ransomware attacks often rely on victims making a few basic mistakes that are often quite uncomfortable to confront,” explains Paul Ducklin, the Principal Research Scientist at Sophos. And, as is the case with most blackmail, paying the blackmailers doesn’t necessarily ensure that information won’t be leaked. All you have is a pinky promise from a bad-faith actor that they will keep their word — and Cognizant’s clients seemed to be aware of this little complication. “Some clients opted to suspend access to their networks. Billing was therefore impacted for a period of time, yet the cost of staffing projects remained on our books,” said Humphries. The approach that hackers take is called ‘steal, lock and inform’ because they understand the impact this will have on the company’s reputation. “The attack encrypted some of the internal systems, effectively defaming them and we proactively took other systems offline,” added Humphries. There’s no reset button, there’s no way to get the information back and it takes time to determine how much data has been lost since attackers erase any directories or back-ups a company may have in place. “Backing up data is just a hygiene step that needs to be taken by every data storing facility mandatorily, however it is not enough,” said Saurabh Sharma, a Senior Security Researcher for Kaspersky. See also: <a href="https://www.businessinsider.in/business/news/cognizant-q1-net-falls-16-7-pc-to-usd-367-mn-sees-challenging-demand-environment-in-2020/articleshow/75616476.cms">Cognizant CEO Brian Humphries warns of a tough 2020— plans to hire 20,000 freshers this year</a> <a href="https://www.businessinsider.in/business/news/lockdown-hyundai-rolls-out-200-vehicles-from-chennai-plant-on-first-day-of-resuming-operations/articleshow/75642579.cms">Hyundai rolls out 200 vehicles from Chennai plant on first day of resuming operations</a> <a href="https://www.businessinsider.in/india/news/coranavirus-cases-in-punjab-news-and-updates/articleshow/74771047.cms">Punjab board to promote class 10 students without final exams due to Covid-19 crisis</a>

The Cognizant Maze ransomware saga will show its full impact for many months to come

<ul><li>The Maze <keyword id="6465154" type="UNKNOWN" weightage="20" keywordseo="ransomware-attack">ransomware attack</keyword> on <keyword id="28721" type="CITY" weightage="20" keywordseo="Cognizant">Cognizant</keyword> workers will have an impact on its revenue and operations in the coming year, according to the company filings with the Securities and Exchange Commission (SEC) in the US.</li><li>The attack has put <keyword id="6357549" type="UNKNOWN" weightage="20" keywordseo="Indian-IT-companies">Indian IT companies</keyword> like Infosys, Wipro and Tata Consultancy Services (TCS) on alert to continuously monitor their own systems.</li><li>According to Infosys’ chief operating officer, the ransomware attack had nothing to do with working from home. The same attack could have just as easily occurred even if employees were working from an office.</li><li>Other ways to exploit the systems, like phishing and malware, are a greater risk to a network when working from home.</li></ul>The Fortune 500 company <a href="https://www.businessinsider.in/tech/news/cognizant-hit-by-maze-ransomware-service-disrupted-for-some-clients/articleshow/75234787.cms">Cognizant</a> was the victim of a ransomware attack last week on Friday, April 17. This has put Indian IT companies like Infosys on high alert. Even though cybercriminals seem to have become more active during the coronavirus lockdown, working from home isn’t the primary issue. It’s about ensuring that networks have advanced threat protection and that they’re continuously monitored for breaches. “We have looked at our own networks and found out that our networks are secure. We’ve invested in advanced protection software which has been deployed at all the endpoints and across the networks,” said <a href="https://www.businessinsider.in/business/corporates/news/infosys-earnings-q4-2020-revenue-dividend-profit-and-margins/articleshow/75252356.cms">Pravin Rao</a>, the chief operating officer of Infosys, during the fourth-quarter earnings call on April 20. Tata Consultancy Services (<a href="https://www.businessinsider.in/business/corporates/news/tcs-ceo-says-the-business-model-is-20-years-old-and-its-time-to-go-employee-lite/articleshow/75243124.cms">TCS</a>) has shifted from the concept of offshore development centres (ODCs) to secure borderless workspaces (<a href="https://www.businessinsider.in/business/corporates/news/tcs-ceo-says-the-business-model-is-20-years-old-and-its-time-to-go-employee-lite/articleshow/75243124.cms">SBWS</a>). It is also looking into solutions that can help its employees work from home without compromising on security. However, that was already in the works even before news of the Cognizant ransomware broke. "We rejigged our cyber security posture, and all our project management practices and systems to ensure that proper work allocation, work monitoring and reporting continued, so that the high quality and delivery certainty that our customers have come to expect from us was never compromised," TCS CEO Rajesh Gopinathan explained during the company's earnings call on April 16. The ransomware may hit Cognizant’s revenue, according to company filings made with the US Securities and Exchange Commission (<a href="https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&amp;CIK=0001446811&amp;owner=exclude&amp;count=40&amp;hidefilings=0">SEC</a>). Not only did the attack have an immediate impact, but continues to cause disruption in parts of its business processes. The Maze ransomware has been around for less than a year, but its damage to businesses and government has only escalated. Ransomware attacks don’t have anything to do with working from home Those behind Maze are known to target IT support companies in the past as well. In October last year, it tried to infiltrate a management service provider (MSP) in Italy by impersonating the Italian Revenue Agency via email, according to a report by Proofpoint. Experts believe this may have been an attempt to gain backdoor access to the MSPs, so that the ransomware could be pushed out to their clients. With the coronavirus pandemic, more employees than ever are working from home. Across the board — for Infosys, HCL Technologies, Wipro and TCS — more than 90% of their employees are working from home. However, working from home isn’t what is making the networks weaker. The same could have just as easily occurred even when employees were working from offices, according to Rao. “Whatever has happened with this ransomware threat, it has nothing to do with work from home. If I look at the vulnerability, it could have happened anywhere irrespective of work from home because it exploited a particular version of a product,” Rao said. IT giants are beefing up their own security Ransomware is persistent enough to attack anywhere but that doesn’t mean that there’s a greater risk to a network when working from home. “Work from home may have a higher impact, less from a security perspective, but more from phishing attacks than data leaks. Security breaches can happen even when you’re working from the office,” said Rao. Last week, between April 13 and April 19, hackers attacked businesses over 22 million times, according to data compiled with Atlas VPN. There were at least 2 million attacks on average per day. During the last 30 days, cybercriminals have tried to infiltrate corporate networks nearly 100 million times. Wipro was already a <a href="https://www.businessinsider.in/wipro-phishing-attack-computer-system-hacked/articleshow/68918449.cms">victim of one such phishing attack</a> in April last year when employee accounts were used to gain access to customer information. “Successful ongoing cyber resilience will require the strategic alignment of cyber strategies with incident response, business continuity and disaster recovery planning. We’ve got to involve the entire enterprise — from the front office to back,” said Akhilesh Tuteja, co-leader of global <keyword id="6361948" type="UNKNOWN" weightage="20" keywordseo="cybersecurity">cybersecurity</keyword> at KPMG International. Going forward, businesses will need to invest more in cybersecurity, both on having the right tools as well as the right manpower in place. Business-driven risk scenarios are currently lacking, according to a KPMG report on key cybersecurity considerations for 2020. Companies’ operating model needs to be in line with cybersecurity. Not only is that important for IT service companies to keep their networks and revenues secure but also maintain trust with their clients. Note: Story was edited to add TCS CEO Rajesh Gopinathan quote from earnings call. See also: <a href="https://www.businessinsider.in/business/corporates/news/infosys-earnings-q4-2020-revenue-dividend-profit-and-margins/articleshow/75252356.cms">Infosys’ revenue, profit and margin in the red as Coronavirus sweeps over the global economy</a> <a href="https://www.businessinsider.in/tech/news/cognizant-hit-by-maze-ransomware-service-disrupted-for-some-clients/articleshow/75234787.cms">Cognizant hit by Maze ransomware, service disrupted for some clients</a> <a href="https://www.businessinsider.in/business/news/companies-might-look-to-bring-in-a-new-set-of-workforce-after-covid-19-crisis-bots/articleshow/75263915.cms">Companies might look to bring in a new set of workforce after COVID-19 crisis — bots</a>

Cognizant's ransomware attack is making peers like TCS and Infosys nervous — and they are beefing up security

New Delhi, May 8 () IT services major Cognizant on Friday said it anticipates the revenue and corresponding margin impact of the ransomware attack, reported in April, to be in the range of USD 50-70 million in the second quarter. Last month, Cognizant had said it has become a victim of the 'Maze' ransomware attack that has caused disruptions to some of its clients. It had said it is in communication with clients and had provided them with indicators of compromise (IOCs) and other technical information of a defensive nature. "...the ransomware attack in April negatively impacted our work-from-home enablement schedule. As a result of this ransomware attack, our Q2 revenue and margins will both be negatively impacted," Cognizant CFO Karen McLoughlin said during an investor call. McLoughlin said while the revenue impact related to this issue is expected to be largely resolved by the middle of the quarter, the company anticipates the revenue and corresponding margin impact to be in the range of USD 50 million to USD 70 million for the quarter. "Additionally, we expect to incur certain legal, consulting and other costs associated with the investigation, service restoration and remediation of the breach," she said. Cognizant CEO Brian Humphries said the attack has been contained. "...the attack encrypted some of our internal systems, effectively disabling them, and we proactively took other systems offline. This disruption included both, select system supporting our work-from-home enablement such as VDI and the provisioning of laptops that have been expected to further increase our work-from-home capabilities in April," he explained. Humphries said in the wake of the ransomware attack, some clients had opted to suspend Cognizant's access to their networks. "Billing was therefore impacted for a period of time, yet the cost of staffing these projects remained on our books...following the containment of the ransomware attack, we have meaningfully progressed in addressing the concerns of clients that have suspended our access to their networks. We expect to substantially complete this by the end of the month," he added. Speaking to , Humphries said no clients have been lost on account of the incident. "On the contrary, a number of the clients have said the manner in which we managed (the situation), it gives them even more confidence in Cognizant because we were extremely client-centric throughout and very communicative. So sometimes in times like this, you can actually strengthen your relationship with clients," he said. Asked if the company will consider work-from-home (WFH) as a practice in the long term, Humphries said the company's first priority is the health and safety of its associates. "In the weeks and months ahead, I think what we'll see is, of course, societies around the world, including in India, determining when to free up social distancing and lockdowns. "Part of our responsibility as a leadership team is to contemplate future workplace environments and be prepared for the return of employees safely to the new reality," he said. He added that experiencing work from home environment can allow companies to retain more employees, and foster a more diverse workforce (especially women employees). "So, there are some positives to work from home environment, but we also need to understand what the new rules are," he said, adding that it will be important to see how WFH functions in a non-lockdown environment. Humphries said there had been no material impact on account of transitioning to WFH, and in fact, the March quarter was big from bookings perspective. Cognizant has reported a revenue growth of 2.8 per cent (3.5 per cent rise in constant currency) to USD 4.2 billion in the March quarter, and said it expects a challenging demand environment throughout 2020 amid the coronavirus outbreak. Cognizant, which follows the January-December financial year, had previously withdrawn its FY20 guidance amid uncertainties on account of the pandemic. Humphries said the company remains confident that its strong business mix, balance sheet and liquidity will help it weather the storm. He said since over 60 per cent of Cognizant's business is in financial services and healthcare, it is less exposed to some of the hardest hit industries like travel, hospitality, retail and automotive. Also, a majority of its business comes from North America, which tends to be more resilient in overseas markets. "We feel very good about our position, we know we can weather the storm, and we will continue to hire in India as evidenced by the 20,000 hiring commitment we've made, as well as other key initiatives," he said. In 2020, the company plans to continue investments in developing digital skills, build the commercial team, and correct the employee pyramid by onboarding about 20,000 entry-level hires. The company also aims to significantly decrease other costs including corporate overhead, travel, marketing, relocations and non-commercial lateral hires, it said. SR ABMABM

Cognizant expects revenue, margin impact of ransomware attack to be USD 50-70 mn in Q2

<ul><li>The tech major expects a $50 million to $70 million hit in the ongoing quarter due to the ransomware attack.</li><li>The management projected margins to remain below 16-17% in 2020. </li><li>Cognizant shares are down 17.80% from the recent peak on February 6. They have under-performed the Nasdaq which is down 0.66% year to date. </li></ul>IT major Cognizant has reported a 16.7% drop in its March quarter net income at $367 million, and said it expects a challenging demand environment throughout 2020 amid the coronavirus pandemic. Cognizant follows January-December as financial year. Its net profit was at $441 million in the March 2019 quarter. In 2020, the company plans to continue investments in developing digital skills and wants to hire about 20,000 entry-level hires to adjust the employee cost structure. 41% of the first-quarter revenue came from digital services and they grew by 19% compared to the same time last year. SEE ALSO: <a href="https://www.businessinsider.in/tech/enterprise/news/cognizant-ransomware-attack-impact-to-get-worse-in-q2-and-coming-quarters/articleshow/75644164.cms" data-type="tilCustomLink" target="_blank">The Cognizant Maze ransomware saga will show its full impact for many months to come</a> The US-headquartered company, which has about 2 lakh employees based in India, had previously withdrawn its FY20 guidance amid uncertainties on account of COVID-19 pandemic. Cognizant shares are down 17.80% from the recent peak on February 6. They have under-performed the Nasdaq which is down 0.66% year to date. The quarterly revenue was at $4.2 billion, up 2.8% (3.5% rise in constant currency) from the year-ago period. "We executed well in what was a challenging quarter, and posted our strongest quarterly signings since 2017," <keyword id="7606578" type="UNKNOWN" weightage="20" keywordseo="Cognizant-CEO-Brian-Humphries">Cognizant CEO Brian Humphries</keyword> said. The company projected margins to remain below 16-17% in 2020. The second quarter (April-June 2020) including a $50-70 million impact due to the Maze ransomware attack, apart from business demand uncertainty and increased costs due to the COVID-19 pandemic. "Since becoming aware of the attack, the company has taken decisive actions to remediate the threat while keeping clients regularly informed. The company believes these measures enabled it to continue its operations in a timely and secure manner," it said. Cognizant noted that since over 60% of its business is in financial services and healthcare, it is less exposed to some of the hardest hit industries, including travel, hospitality, retail and automotive. Coronavirus-related disruptions reduced revenue in March, reflecting delays in project fulfillment as Cognizant rapidly enabled the shift to work-from-home capabilities across its delivery teams. SEE ALSO: <a href="https://www.businessinsider.in/business/corporates/news/hcl-tech-follows-tcs-and-infosys-lead-says-50-of-its-employees-will-work-from-home-even-after-the-lockdown-is-lifted/articleshow/75593968.cms" data-type="tilCustomLink" target="_blank">HCL Tech follows TCS and Infosys' lead — says 50% of its employees will work from home even after the lockdown is lifted</a> <a href="https://www.businessinsider.in/tech/news/sudhir-krishnaswamy-on-facebook-oversight-board-which-will-control-controversial-content-on-facebook-and-instagram/articleshow/75593282.cms" data-type="tilCustomLink" target="_blank">Meet the Indian on Facebook's oversight board which will police content on Facebook and Instagram</a> <a href="https://www.businessinsider.in/business/corporates/news/tcs-ceo-says-the-business-model-is-20-years-old-and-its-time-to-go-employee-lite/articleshow/75243124.cms" data-type="tilCustomLink" target="_blank">TCS CEO says the business model is 20 years old — hinting that it may be time to go employee-lite</a>

Cognizant CEO Brian Humphries warns of a tough 2020— plans to hire 20,000 freshers this year

<ul><li>A third-party cloud service provider <keyword id="9634302" type="UNKNOWN" weightage="20" keywordseo="blackbaud">Blackbaud</keyword> was hacked in May but only disclosed the breach on July 23. </li><li>It manages the IT services for the University of York, University of London, <keyword id="312623" type="ORGANIZATION" weightage="20" keywordseo="Oxford-College">Oxford college</keyword> and other educational institutions. </li><li>Blackbaud claims it was able to get the hackers out of its system but only after “a subset of data” was copied off the servers, which is why they had to pay the ransom.</li></ul>One of the world’s leading non-profit software companies was the target of a <keyword id="6465154" type="UNKNOWN" weightage="20" keywordseo="ransomware-attack">ransomware attack</keyword>. A fact they only revealed in July even though the attack was originally detected in May by the company. The hack has reportedly affected universities, non-profit organisations, and foundations. Blackbaud claims that once it spotted the cybercriminals, the company’s IT experts were able to expel the hackers from the system. Blackbaud pays the <keyword id="6362094" type="PERSON" weightage="20" keywordseo="Ransomware">ransomware</keyword> Before the hackers got locked out, the attackers were able to remove “a copy of a subset of data”. The group behind the attack then asked for compensation with the threat of releasing the data to the public. “Because protecting our customers’ data is our top priority, we paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed,” said Blackbaud in a <a href="https://www.blackbaud.com/securityincident">statement</a>. The payment was made to ensure that the data will not be circulated, misused, or otherwise be made publicly available, according to the company. The company asserts that no credit card, bank account, or social security information was stolen by the hackers. List of universities that have confirmed being a target of the attack: <ol><li>University of York </li><li>Oxford Brookes University </li><li>Loughborough University </li><li>University of Leeds </li><li>University of London </li><li>University of Reading </li><li>University College (Oxford) </li><li>Ambrose University (Canada) </li><li>Rhode Island School of Design (US) </li><li>University of Exeter </li></ol>There has been a 20% jump in ransomware attacks globally, second only to Internet-of-Things malware as per SonicWall’s <a href="https://www.sonicwall.com/2020-cyber-threat-report/">Cyber Threat Report 2020</a>. The attack on Blackbaud is inline with more operators increasing their focus on ‘soft targets’ like education, hospitals and public administration agencies. The two-month wait The bigger issue to be addressed is that the General Data Protection Regulation (GDPR) has asserted that companies must report data breaches to authorities within 72 hours of discovery — or face the consequences in the forms of fines. The <a href="https://www.bbc.com/news/technology-53516413">BBC</a> reports that the UK's Information Commissioner's Office (ICO), as well as the Canadian data authorities, were only informed about the breach last weekend, which is much later than when Blackbaud originally uncovered the threat. SEE ALSO: <a href="https://www.businessinsider.in/tech/enterprise/news/82-of-companies-in-india-were-hit-by-ransomware-they-paid-rs-8-crore-on-average-to-save-themselves/articleshow/75827204.cms">82% of companies in India were hit by ransomware — they paid ₹8 crore on average to save themselves</a> <a href="https://www.businessinsider.in/tech/enterprise/news/cognizant-ransomware-attack-impact-to-get-worse-in-q2-and-coming-quarters/articleshow/75644164.cms">The Cognizant Maze ransomware saga will show its full impact for many months to come</a> <a href="https://www.businessinsider.in/tech/news/priyanka-chopra-lady-gaga-and-madonna-ransomware-attack-by-revil-known-to-follow-through-on-blackmail-threat/articleshow/75708155.cms">Ransomware attack puts Priyanka Chopra, Lady Gaga, Madonna and other celebrities’ data at risk — and REvil hackers are known to follow through on their threats</a>

Ransomware hits IT services giant — they paid the ransom even after locking hackers out of the system

<ul><li>US-based Grubman Shire Meiselas &amp; Sacks, which manages celebrities like <keyword id="1655" type="PERSON" weightage="20" keywordseo="Priyanka-Chopra">Priyanka Chopra</keyword>, Drake, <keyword id="15313" type="PERSON" weightage="20" keywordseo="Madonna">Madonna</keyword> and many others, has been the victim of a <keyword id="9211816" type="UNKNOWN" weightage="20" keywordseo="revil-ransomware">REvil ransomware</keyword> attack. </li><li>The law firm has confirmed the breach and cybersecurity firm Emisoft claims the hackers posted evidence of data theft on the dark web.</li><li>Cybersecurity experts told Business Insider that ransomware attacks are now a ‘double-barrelled weapon’ and having mitigation policies in place is the only way to prevent them.</li></ul>After reports of a <keyword id="6465154" type="UNKNOWN" weightage="20" keywordseo="ransomware-attack">ransomware attack</keyword> on leading IT company Cognizant, hackers have now breached the US-based Grubman Shire Meiselas &amp; Sacks law firm. It manages cases for several prominent celebrities — including Priyanka Chopra, <keyword id="6358169" type="UNKNOWN" weightage="20" keywordseo="Lady-GaGa">Lady Gaga</keyword>, Drake, Madonna, Jessica Simpson, Bruce Springsteen and several others. “REVil, also known as Sodin or Sodinokibi, isn’t just operating on the old-school ransomware model of ‘scramble your files and offer to sell you back the decryption key’. The latest trend in ransomware attacks is to use a double-barrelled weapon that gives victims two reasons to pay up,” said Paul Ducklin, the Principal Research Scientist at Sophos. In March, operators of REvil ransomware <a href="https://nakedsecurity.sophos.com/2020/03/23/stolen-data-of-company-that-refused-revil-ransom-payment-now-on-sale/">published over 12 GB of data</a> that allegedly belongs to one of its victims – Brooks International – after they refused to pay the ransom. “You need to hand it over to the experts for a forensic investigation. They will be able to determine what is jeopardized, what is not erased. They will take over potentially communicating with the attackers after they understand the depth of the attack,” Cyberproof President Yuval Wollman, the former Director General of the Israeli Intelligence Ministry— who has been working with customers who were affected, can potentially be targets of ransomware — told Business Insider. Emisoft told <a href="https://variety.com/2020/digital/news/entertainment-law-firm-hacked-data-breach-lady-gaga-madonna-bruce-springsteen-1234602737/">Variety</a> that the evidence of the 756-gigabyte (GB) data theft was posted via a forum on the dark web. The treasure trove of information including contracts, nondisclosure agreements, phone numbers, email addresses and personal correspondence. “Today we see attackers taking advantage of the new normality,” said Wollman. Digital blackmail — to pay or not to pay? The basis of the ransomware attack is not unlike conventional blackmail, except that its online. The hackers steal information that can then be used to extort the victims for compensation, normally monetary in the form of bitcoins. The question then is whether or not the victims should pay up since all they have to go on is a pinky promise from a thief that they won’t release the data even after payment is made. “My recommendation would be, do not communicate directly with the hacker. This is exactly why you have security teams, whether it’s an in-house team or a combination of the IT security team in collaboration with an external partner,” said Wollman. The cybercriminals behind the REvil ransomware attack are threatening to release the data stolen from Grubman Shire Meiselas &amp; Sacks in nine instalments. “The crooks quietly upload huge troves of so-called ‘trophy data’ that they use to blackmail anyone who is hesitant to pay up,” said Ducklin. “In other words, the financial extortion is no longer just a “kidnap ransom” to get your files back, but also a blackmail demand to stop the crooks leaking your data – or, worse still, your customers’ data – to the world,” he explained. Prevention is better than the cure Right now, <a href="http://www.gsmlaw.com/">Grubman Shire Meiselas &amp; Sacks</a> website is nothing more than their logo. Even though the law firm has confirmed the hack, they are yet to disclose how much of their data has been lost for good. While backing up data is a good mitigation strategy, it’s not full-proof, according to Wollman. “Ransomware attacks that steal masses of data first, and where the crooks carefully learn their way around your network, very often leave telltale signs that someone is hanging around where they shouldn’t,” said Ducklin. “Crooks who pull off all-your-network-at-once attacks can afford to spend time probing for any existing holes they know about. Make it harder for them by patching known bugs as soon as you can,” he explained. In the case of Cognizant, the ransomware attack was initiated by Maze — another cybercrime gang — using a phishing email, according to Wollman. The source of the ransomware attack on Grubman Shire Meiselas &amp; Sacks is still unknown. The issue with such attacks is that it’s not only the firm or the company that’s put at risk but also its customers. The information that’s stolen can lead to identity theft, impersonation and a number of other fraudulent activities. They serve as important reminders for companies to stay on their toes and not take cybersecurity lightly. SEE ALSO: <a href="https://www.businessinsider.in/tech/news/experts-explain-the-legal-and-moral-pitfalls-in-aarogya-setu-app-despite-the-governments-insistence-that-a-protocol-has-been-put-in-place/articleshow/75690239.cms">Experts explain the legal and moral pitfalls in Aarogya Setu app ⁠— despite the government’s insistence that a protocol has been put in place</a> <a href="https://www.businessinsider.in/tech/news/twitter-just-told-employees-they-can-work-from-home-permanently/articleshow/75703049.cms">Twitter just told employees they can work from home permanently</a> <a href="https://www.businessinsider.in/entertainment/news/ellen-degeneres-reportedly-once-called-steve-jobs-to-complain-about-her-iphone-she-just-lives-in-an-incredibly-privileged-bubble/articleshow/75681999.cms">Ellen DeGeneres reportedly once called Steve Jobs to complain about her iPhone: 'She just lives in an incredibly privileged bubble'</a>

Ransomware attack puts Priyanka Chopra, Lady Gaga, Madonna and other celebrities’ data at risk — and REvil hackers are known to follow through on their threats

Indian firms paid over Rs 8 crore ransom on average to mitigate the impact of <keyword id="6362094" type="PERSON" weightage="20" keywordseo="Ransomware">ransomware</keyword> on its operations and overall, 82 per cent Indian firms were hit by ransomware in the past 12 months, a 15 per cent increase from 2017, a new report said on Tuesday. Two out of three (66 per cent) organisations hit by ransomware in India admitted paying the ransom. Data was encrypted in 91 per cent of attacks that successfully breached an organisation in India. The average cost of addressing the impact of such an attack in India, including business downtime, lost orders, operational costs, and more, was a little over Rs 8 crore. Delhi topped the list as 85 per cent organisations in the national capital were hit by ransomware attacks in the past 12 months, followed by Bengaluru (83 per cent) and Kolkata (81 per cent). At fourth spot was Mumbai-based firms (81 per cent), Chennai (79 per cent) at sixth place and Hyderabad (74 per cent) seventh, according to the "state of ransomware 2020" global survey by cybersecurity firm Sophos. Ransomware is a form of malware that encrypts a victim's files. The attacker then demands a ransom from the victim to restore access to the files. According to Chester Wisniewski, principal research scientist, Sophos, organizations may feel intense pressure to pay the ransom to avoid damaging downtime. "On the face of it, paying the ransom appears to be an effective way of getting data restored, but this is illusory. Paying the ransom makes little difference to the recovery burden in terms of time and cost," he said. This could be because it is unlikely that a single magical decryption key is all that's needed to recover. "Often, the attackers may share several keys and using them to restore data may be a complex and time-consuming affair," said Wisniewski. According to the report, only 8 per cent of victims in India were able to stop the attack before their data could be encrypted, compared with a global average of 24 per cent. Nearly 29 per cent of the IT managers surveyed were able to recover their data from backups without paying the ransom. Globally, the average cost of recovery is $1.4 million if organisations pay the ransom and $730,000 if they don't. The survey polled 5,000 IT decision makers in organisations in 26 countries across six continents. Every organization in India that paid the ransom got their data back, although this was not always the case elsewhere. Globally, nearly 5 per cent of public sector organizations paid the ransom but didn't get their data back. In fact, 13 per cent of the public sector organizations surveyed never managed to restore their encrypted data, compared to 6% overall. "An effective backup system that enables organizations to restore encrypted data without paying the attackers is business critical, but there are other important elements to consider if a company is to be truly resilient to ransomware," informed Wisniewski. SEE ALSO: <a href="https://www.businessinsider.in/tech/news/cognizants-ransomware-attack-is-making-peers-like-tcs-and-infosys-nervous-and-they-are-beefing-up-security/articleshow/75271532.cms">Cognizant's ransomware attack is making peers like TCS and Infosys nervous — and they are beefing up security</a> <a href="https://www.businessinsider.in/tech/enterprise/news/cognizant-ransomware-attack-impact-to-get-worse-in-q2-and-coming-quarters/articleshow/75644164.cms">The Cognizant Maze ransomware saga will show its full impact for many months to come</a> <a href="https://www.businessinsider.in/tech/news/priyanka-chopra-lady-gaga-and-madonna-ransomware-attack-by-revil-known-to-follow-through-on-blackmail-threat/articleshow/75708155.cms">Ransomware attack puts Priyanka Chopra, Lady Gaga, Madonna and other celebrities’ data at risk — and REvil hackers are known to follow through on their threats</a>

You Searched For "cognizant maze attack" and got 8 results

Cognizant hit by Maze ransomware, service disrupted for some clients

PTI

The Cognizant Maze ransomware saga will show its full impact for many months to come

Prabhjote Gill

Cognizant's ransomware attack is making peers like TCS and Infosys nervous — and they are beefing up security

Prabhjote Gill

Cognizant expects revenue, margin impact of ransomware attack to be USD 50-70 mn in Q2

PTI

Cognizant CEO Brian Humphries warns of a tough 2020— plans to hire 20,000 freshers this year

Sriram Iyer

Ransomware hits IT services giant — they paid the ransom even after locking hackers out of the system

Prabhjote Gill

Ransomware attack puts Priyanka Chopra, Lady Gaga, Madonna and other celebrities’ data at risk — and REvil hackers are known to follow through on their threats

Prabhjote Gill

82% of companies in India were hit by ransomware — they paid ₹8 crore on average to save themselves

IANS