Ragnar Locker Ransomware Attacks Energy Company, Potentially Stealing 10TB in Data

In a letter to customers, EDP Renewables North America CEO acknowledges the attack occurred back in April of this year, but claims “no evidence” of data theft exists.

The ransomware “note” demanded approximately $10 million in Bitcoin. It also included a warning that over 10TB of information had been exfiltrated from encrypted systems, offering to decrypt some of the impacted files for free as a demonstration of their claim. EDP declined to pay the ransom and data has yet to be published.

This attack demonstrates a few things. First, it shows how pervasive ransomware can be. The attack started in the network of EDP Renewable’s parent company, Energias de Portugal in April, with their American subsidiary learning about the attack in early May. Second, it shows how integrated the idea of stealing data as part of a ransomware attack (whether actual or simply claimed) is becoming the norm. I’ve talked about the Maze “cartel” before – there are are plenty of ransomware gangs that partake in the “steal-and-publish” ransomware method. But, it appears, thus far, that in the case of the attack in EDP, it’s merely a statement meant to improve the chances of payment.

There is no detail on how many systems were impacted, but judging by the claim of 10TB, one would assume at least 10TB of data was encrypted, implying a number of critical systems were affected.

Avoiding this kind of attack is the only good advice I can offer; even if you don’t (and shouldn’t) pay the ransom, it will be days-to-weeks to see operations return to normal. Security Awareness Training is one of the most effective ways to stop user-targeted attacks. By educating the user on what to look for, avoiding malicious email and web content becomes second nature, stopping ransomware and other attacks before they even start.