Hacker News Reader

Comment by Scirra_Tom | Hacker News Reader

Devastating for them I imagine. Website offline since 31st December, purposefully timed attack for maximum disruption I would imagine.

Looks like they had aspiration to IPO earlier in 2019, imagine this would now not be on the cards for a long time.

I wonder how much the ransom is for. It appears to be an enormously damaging attack - I wonder if paying it is the best option for their business at this stage, then follow the money.

View on HN

The problem with paying it is that even if it works, and all the machines decrypt in a timely fashion, you have no idea if the attackers have left anything else in the network that they could use to enter again.

You might not even find out the original entry point, and stop others following. Also it will be expensive.

You still may never find the entry point if you don't recover the machines. Saudi Aramco and Maersk fell victim to similar ransomware attacks and practically had to start from scratch buying storage devices straight from manufacturers to get back online. NotPetya was so destructive it didn't leave behind much in the way of meaningful evidence. If you don't recover the encrypted data you probably won't recover evidence that points to patient zero anyway.

Episodes 53 and 54 of https://darknetdiaries.com/episode/ are a good listen on this subject.

A bigger problem is that you've now painted a huge target on your back as a company that is known to have security problems and pay ransoms.

Finablr, Travelex's parent company IPO'd last year. Stock price is not looking too healthy today.

Reply on news.ycombinator.com