Microlise Faces Disruption After SafePay Ransomware Attack
Ransomware Attack on Microlise: SafePay Claims Responsibility
Microlise Group plc, a prominent UK-based technology provider specializing in Software as a Service (SaaS) solutions for fleet management and the industrial Internet of Things (IoT), has been targeted by a ransomware attack. The SafePay ransomware group has claimed responsibility for the breach, which led to the exfiltration of 1.2 terabytes of data, significantly disrupting Microlise's operations.
About Microlise
Since its inception in 1995, Microlise has carved out a significant niche in the logistics and transportation sector, offering a wide array of telematics and fleet management solutions. With a team of approximately 775 employees, the company caters to around 400 enterprise clients worldwide. Microlise's innovative solutions have garnered multiple accolades, including the Queen's Awards for Enterprise. Their extensive product range aids businesses in optimizing logistics operations, enhancing safety, and ensuring regulatory compliance.
Attack Overview
In October, Microlise confirmed a ransomware attack, with SafePay later taking responsibility. The breach caused disruptions in customer systems, affecting tracking systems and panic alarms used by major operators like DHL and Serco. Despite efforts to restore systems, Microlise acknowledged the potential compromise of employee data. The incident has been reported to international authorities, and the company has assured stakeholders that customer systems data remained intact.
SafePay Ransomware Group
SafePay is a relatively new entity in the ransomware arena, known for its ransomware-as-a-service (RaaS) model and use of LockBit source code. The group employs a double-extortion strategy, encrypting files and threatening to release stolen data if ransom demands are not met. SafePay maintains a low profile in the cybercrime community, typically gaining access to victim networks through valid credentials, often acquired via VPN gateways, thus avoiding more detectable methods like Remote Desktop Protocol (RDP).
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!