Volkskrant: ransomware gang demands 800,000 euros ransom from Hof van Twente
Hackers who have infected the Hof van Twente municipality with ransomware have also been able to encrypt the backup servers. The group demands 800,000 euros in ransom and, according to de Volkskrant, threatens to put data online.
De Volkskrant was able to contact the hackers, who demand fifty bitcoins as ransom for their ransomware. It is not known which ransomware is involved. However, the newspaper writes that the criminals gained access by brute-forcing passwords for access via the Remote Desktop Protocol. When the criminals entered the system, they encrypted 24 virtual servers and stole the data from them. According to the Volkskrant, the criminals demand fifty bitcoins in ransom. That is with the current exchange rate of the currency, which is almost at a record high, just under 800,000 euros.
The municipality of Hof van Twente was hit by a cyber attack last week. At that time it was not yet known that it was ransomware, although it already seemed so. De Volkskrant was able to contact the criminals via the e-mail address stated in the ransom note. It is striking that the municipality itself, but also the police have not yet contacted the group. According to the municipality, this would be because the police advises to take more time for investigations.
In addition to the internal systems, the criminals also encrypted the backups with data. The data has also been stolen. The hackers are threatening to make that information public, a trend that more and more ransomware gangs have been following since this year. It would be very sensitive information.
The municipality does not want to tell the Volkskrant whether it intends to pay or not. The police and municipality would have been unable to access the encrypted servers for a long time, because the ICT provider Switch IT Solutions did not want to provide the usernames and passwords. Forensic company NFIR is now also involved in the investigation.