Log in
Forgot password ?
Become a member for free
Sign up
Sign up
New member
Sign up for FREE
New customer
Discover our services
Dynamic quotes 

MarketScreener Homepage  >  Indexes  >  USA  >  S&P 500    SP500

S&P 500

SummaryMost relevantAll NewsNews of the index componentsMarketScreener Strategies

'Payment sent' - travel giant CWT pays $4.5 million ransom to cyber criminals

share with twitter share with LinkedIn share with facebook
07/31/2020 | 11:32am EDT
Travel giant CWT pays $4.5 mln ransom to cyber criminals

U.S. travel management firm CWT paid $4.5 million this week to hackers who stole reams of sensitive corporate files and said they had knocked 30,000 computers offline, according to a record of the ransom negotiations seen by Reuters.

The attackers used a strain of ransomware called Ragnar Locker, which encrypts computer files and renders them unusable until the victim pays for access to be restored.

The ensuing negotiations between the hackers and a CWT representative remained publicly accessible in an online chat group, providing a rare insight into the fraught relationship between cyber criminals and their corporate victims.

CWT, which posted revenues of $1.5 billion last year and says it represents more than a third of companies on the S&P 500 U.S. stock index, confirmed the attack but declined to comment on the details of what it said was an ongoing investigation.

"We can confirm that after temporarily shutting down our systems as a precautionary measure, our systems are back online and the incident has now ceased," it said in a statement.

"While the investigation is at an early stage, we have no indication that personally identifiable information/customer and traveller information has been compromised."

CWT said it had immediately informed U.S. law enforcement and European data protection authorities.

A person familiar with the investigation said the company believed the number of infected computers was considerably less than the 30,000 the hackers told CWT they had infected.


The hackers initially demanded a payment of $10 million to restore CWT's files and delete all the stolen data, according to the messages reviewed by Reuters. "It's probably much cheaper than lawsuits expenses (sic), reputation loss caused by leakage," the attackers wrote on July 27.

The CWT representative in the negotiations, who said they were acting on behalf of the firm's chief financial officer, said the company had been badly hit by the COVID-19 pandemic and agreed to pay $4.5 million in the digital currency bitcoin.

"Okay let's get this moving forward. What are the next steps?" the representative said after agreeing to the ransom.

A public ledger of digital currency payments, known as the blockchain, shows that an online wallet controlled by the hackers received the requested payment of 414 bitcoin on July 28.

Messages sent to email addresses used by the hackers went unanswered.

In a ransom note left on infected CWT computers and screenshots posted online, the hackers claimed to have stolen two terabytes of files, including financial reports, security documents and employees' personal data such as email addresses and salary information.

It was not clear whether data belong to any of CWT's customers, including Thomson Reuters, was compromised.

Western security officials say ransomware attacks are a consistent and serious threat to businesses and private companies, despite the increased attention usually given to the headline-grabbing antics of state-backed hackers.

Such attacks are thought to cost billions of dollars each year, either in extorted payments or recovery costs.

Cybersecurity experts say the best defence is to keep secure data back-ups, and that paying ransoms encourages further criminal attacks without any guarantee that the encrypted files will be restored.

By Jack Stubbs

Stocks mentioned in the article
ChangeLast1st jan.
BITCOIN - EURO -0.58% 10906.79 Real-time Quote.68.46%
BITCOIN - UNITED STATES DOLLAR -0.19% 12952.255 Real-time Quote.78.93%
DJ INDUSTRIAL -0.10% 28335.57 Delayed Quote.-0.71%
NASDAQ 100 0.25% 11692.571891 Delayed Quote.33.89%
NASDAQ COMP. 0.37% 11548.281629 Delayed Quote.28.71%
S&P 500 0.34% 3465.39 Delayed Quote.7.26%
UNITED PARCEL SERVICE, INC. -0.63% 171.9 Delayed Quote.46.85%
share with twitter share with LinkedIn share with facebook
All news about S&P 500
10:15aRetail Stocks Are Hot Heading Into the Holiday Season
09:00aWall St Week Ahead-More U.S. companies offer earnings guidance despite pandem..
05:45aDividend Darlings Trail Stock Market Despite Pumped-Up Yields
10/23WALL STREET WEEK AHEAD : More U.S. companies offer earnings guidance despite pan..
10/23Stocks mixed; COVID-19 vaccine trials to restart
10/23NEWS HIGHLIGHTS : Top Global Markets News of the Day
10/23NEWS HIGHLIGHTS : Top Company News of the Day
10/23NEWS HIGHLIGHTS : Top Global Markets News of the Day
10/23NEWS HIGHLIGHTS : Top Company News of the Day
10/23WALL STREET STOCK EXCHANGE : Stocks Snap Three-Week Winning Streak
More news
Chart S&P 500
Duration : Period :
S&P 500 Technical Analysis Chart | SP500 | US78378X1072 | MarketScreener
Technical analysis trends S&P 500
Short TermMid-TermLong Term
Heatmap :