Maple Leaf Foods admits ransomware attack, won’t pay attackers

Maple Leaf Foods has confirmed it was hit by ransomware and will not pay for the return of stolen data.

The Black Basta ransomware gang now names Canadian meat processor Maple Leaf Foods as one of its victims. It’s not clear, but this could be related to a cyber incident the company acknowledged earlier this month.

At the time of the incident, a Maple Leaf Foods spokesperson said the IT outage was causing various operational and service disruptions across business units, plants, and sites.

In response to a request for comment from IT World Canada In a statement about the company’s listing by Black Basta, the company said, “We do not dignify criminals by naming them.”

“Unfortunately, we know that the people behind this incident had unauthorized access to some of our data and are threatening to release the data if we do not pay the ransom, but we will not run.”

“We apologize that this has happened, and we apologize for the frustrations and challenges it may cause. We have invested significant resources in the security of our systems and we We take the confidentiality and security of our information very seriously, and we take deliberate actions to do what we believe is the right thing to do to minimize disruption. We also provide 2 years credit monitoring service for our team members.

“Illegal activity that can compromise our systems and compromise our information is intolerable and we will not pay criminals ransoms. (including) not to entertain “leads” from stolen or compromised data, nor to contact anyone based on information obtained illegally. ”

The statement added that by working with experts, we were able to quickly and safely restore our IT systems.

According to security industry sources, the list of Black Basta sites appeared within the last 24 hours. It posted multiple screenshots of various documents allegedly copied from the company, but did not specifically claim the exact amount of data stolen.

Black Basta also credits the recent attack on Sobey’s supermarket chain. His two claims made David Shipley, head of his Beauceron Security in New Brunswick, wonder if the threat group was targeting the food sector. “When it comes to ransomware, I don’t believe in coincidence,” he said in the following email. IT World Canada“This is either sector-centric evidence we have seen before, or there was a connection between the two attacks that have yet to be confirmed.”

Black Basta’s claims are the latest in a series of Canadian ransomware news stories this week. QC’s City of Westmount Admits Ransomware Attack, BianLian Gang Represents Ontario Public High School Teachers in His October Cyber ​​Attack on Luxury Menswear Chain Harry Rosen Unions have started notifying members whose data has been stolen. Ransomware attack in May.

Maple Leaf Foods said in its most recent quarterly financial report that it posted a net loss of C$54.6 million on sales of C$1.195 billion.

We have two departments. The Meat Protein Group manufactures and sells ready-to-eat meats, ready-to-serve and ready-to-serve meals, value-added fresh pork and poultry products to retailers, foodservice, industrial channels and agricultural operations. increase. pork and chicken. The Plant Proteins Group consists of chilled plant protein products, premium grain-based proteins and vegan cheese products sold to retail, food service and industrial channels.

In an alert this week, Cybereason researchers said the Black Basta ransomware gang recently adopted the QakBot malware to create its initial entry point and move laterally within an organization’s IT network. rice field. Over the past two weeks, over 10 of his Cyber ​​eason customers have been affected by this recent campaign. Two of these attacks allowed attackers to deploy ransomware and disable DNS services to lock organizations out of networks, complicating recovery.

QakBot, also known as QBot or Pinkslipbot, is a banking Trojan primarily used to steal victims’ financial data (browser information, keystrokes, credentials, etc.). Once QakBot successfully infects an environment, the malware installs a backdoor that allows the attacker to drop additional malware.

In the attack Cybereason analyzed, the attackers moved very quickly, gaining domain admin rights within two hours and moving on to deploying ransomware within 12 hours. Attacks typically started with employees being tricked into spam/phishing emails containing malicious URL links. That led to the installation of QakBot. Attackers also used her Cobalt Strike toolkit (or a copy of it) to gain remote access to domain her controllers.

Cobalt Strike piracy is a tool of choice for many attackers. To blunt its effectiveness, Google this month released his YARA rules for detecting unauthorized use of Cobalt Strike.