Ransomware attack affecting Tietoevry's services to some customers in Sweden
tietoevry.com
tietoevry.com
I've always thought these centralized point of failures are a bad idea.
That's actually a good hypothesis that hasn't been examined before, I believe.
Source: Worked at "TT Tietotehdas" (organic part of the name, not a suffix, AIUI) in 1996 and have had to do with it every now and then after that.
Not sure how credible that is? I don't understand how that could take down the whole data center.
> BleepingComputer has been told that the Akira ransomware operation is behind the attack on Tietoevry, coming soon after the Finnish government warned about their ongoing attacks against companies in the country.
> "The incidents were particularly related to weakly secured Cisco VPN implementations or their unpatched vulnerabilities. Recovery is usually hard," warned the Finnish NCSC.
I wonder what the entrypoint was back in 2021 when they were attacked around the same time?
[1]: https://www.bleepingcomputer.com/news/security/tietoevry-ran...
Sounds bad.
Rusta is another affected store chain. I guess there is a lot more affected customers unknown to the public right now
Also, a HR system called primula is affected. It is mostly used by universities from what I can gather.
[0] = https://www.dn.se/sverige/it-attacken-paverkar-myndigheter-o... (Swedish, one of the biggest newspaper in Sweden)
Time to work work work work..
It makes it likely that the attackers didn't breach Tietoevry itself, or that they had only very limited access (unless Tietoevry has incredibly good separation between business units, so that only a small subset is affected).
That increases the chance that the customers have to deal with an outage, not an outage followed by ransom demands and their customer data being leaked.