Consulting, IT and accounting firm Accenture has been struck by Lockbit ransomware, but there’s no word yet on whether the gang got their hands on its data.
Key takeaways
- Accenture has been struck by Lockbit ransomware
- It is still not clear if attackers got their hands on the consulting giant’s data
- Accenture has denied that its data was accessed, but there are rumours swirling of a potential payoff
- Cyber industry figures are hopeful that Accenture will refuse any ransom demand to set a strong precedent in the industry
Consulting, IT and accounting firm Accenture has been struck by Lockbit ransomware, but there’s no word yet on whether the gang got their hands on its data.
The ransom note, posted on the dark web, said: “These people are beyond privacy and security… if you’re interested in buying some databases reach us.”
LockBit, like it’s now-defunct DarkSide and REvil counterparts, operates using a ransomware-as-a-service (RaaS) model, roping in other cybercriminals (aka affiliates) to carry out the intrusion using its platform, with the payments often divided between the criminal entity directing the attack and the core developers of the malware.
In a statement, the company confirmed the attack but has not yet confirmed whether data had been accessed, or how much was demanded in ransom.
An Accenture spokesperson said:
Through our security controls and protocols, we identified irregular activity in one of our environments. We immediately contained the matter and isolated the affected servers. We fully restored our affected systems from back-up. There was no impact on Accenture’s operations, or on our clients’ systems.
Rumours on Twitter are being repeated by news outlets claiming a $50m ransom equivalent in cryptocurrency had been demanded by Lockbit’s operators, though there was no hard confirmation of this at the time of publication.
Counter-ransomware firm Emsisoft reckoned in July that the average ransom demanded by the Lockbit gang was “typically high five figures.”
“LockBit operates under the ransomware-as-a-service (RaaS) business model, whereby ransomware developers lease their ransomware to affiliates who receive a portion of ransom payments received from the attacks they carry out,” said the firm’s analysis.
Industry talk of vast payoffs always circulate after a ransomware attack, especially when companies aren’t forthcoming with public communication.
Such rumours are (unfortunately) good publicity for the criminals operating the ransomware, and lead to intense scrutiny of corporate financials and spending in the months afterwards.
We have previously written an extensive insight on Lockbit ransomware.
The gang in question in this particular incident appears to have spun out of the Maze ransomware cartel and avoids targeting organisations based in ex-Soviet countries.
Accenture bought its way into the security market relatively recently, snapping up Symantec’s Cyber Security Services (CSS) operation last year.
While having good cybersecurity operational experience doubtless helps in detection and recovery from any ransomware attack, a company publicly claiming that an attack has had zero effect rarely reflects reality for those whose devices and departments were caught up in the initial wave.
It remains to be seen how serious the Accenture incident is, and what sort of impact it may have on the organisation.
