JBS Paid Hackers $11 Million After Hack Closed Plants
[Ensure you have all the info you need in these unprecedented times. Subscribe now.]
JBS USA said it paid $11 million in ransom to criminals responsible for the cyberattack that disrupted meat processing across North America and Australia, the latest high profile example of large corporations falling prey to extortion.
“This was a very difficult decision to make for our company and for me personally,” JBS USA CEO Andre Nogueira said in a statement. “However, we felt this decision had to be made to prevent any potential risk for our customers.”
The ransom payment was made in Bitcoin, according to a spokesperson for JBS Brazil.
“Private companies should not pay ransom,” a White House National Security Council spokesperson said the night of June 9, without mentioning JBS. “It encourages and enriches these malicious actors, continues the cycle of these attacks, and there is no guarantee companies get their data back.”
On May 25, five people pleaded guilty to staging two accidents in New Orleans with tractor-trailers in 2017, while obtaining fraudulent financial settlements totaling more than $282,000. Is the situation surrounding fraudulent settlements getting worse or better in 2021? Host Michael Freeze talks with TT's Eric Miller and Eleanor Lamb. Hear a snippet above, and get the full program by going to RoadSigns.TTNews.com.
The spokesperson reiterated calls for more cooperation between the government and the private sector to deter ransomware attacks and for companies to “put in place the cybersecurity defenses to meet the threat.”
The $11 million payoff was split and sent to two addresses, a common feature of third-party extortion software where the developer gets a cut, said Tom Robinson, co-founder of Elliptic, which advises crypto firms and regulators on financial-crime risk. The affiliate got about 7% of the JBS payment, which it sent to a privacy-focused wallet, while about $70,000 went to ChipMixer, a so-called mixing service that also makes it harder to trace coins, he added.
“We can’t tell whether law enforcement has seized any of it, but we wouldn’t expect to see law enforcement use mixers/privacy wallets,” Robinson said in an email.
The cyberattack on May 30 forced the Sao Paulo-based meat giant to shut down all of its beef plants in the U.S., accounting for almost a quarter of American supplies. It also halted slaughter operations across Australia and idled one of Canada’s largest beef plants. The FBI has attributed the incident to REvil, a hacking group that researchers say has links to Russia.
The global shutdowns alarmed the agricultural industry and raised concerns about food security as hackers increasingly target critical infrastructure. Operations have returned to normal levels and the company expected lost production to be fully recovered by the end of this week.
Dow Jones had earlier reported the JBS ransom payment.
JBS is the latest company to pay off criminal hackers. Colonial Pipeline Co. paid $4.4 million, or 75 Bitcoin, in ransom after a hack that forced it to shut the largest fuel pipeline in the U.S. five weeks ago, driving up gasoline prices and sparking shortages at filling stations.
RELATED: US Recovers Millions in Ransom From Colonial Pipeline Hackers
Later, the U.S. recouped 63.7 Bitcoin, a sign that law enforcement is capable of pursuing online criminals even when they operate outside the nation’s borders. Because of the declining value of Bitcoin since the Colonial ransom was paid, the U.S. seizure in late May amounted to $2.3 million, just over half the ransom initially paid by Colonial.
More Transparency
The recent spate of cyberattacks has prompted lawmakers to push for greater transparency on ransom payments. Mark Warner, chairman of the Senate Intelligence Committee, said it’s “worth having” a debate over whether to make paying ransoms illegal for U.S. companies as it exacerbates and accelerates the problem.
JBS in its latest statement said the vast majority of the company’s facilities were operational at the time of payment. It made the decision to “mitigate any unforeseen issues related to the attack and ensure no data was exfiltrated” in consultation with internal IT professionals and third-party cybersecurity experts.
The company added it has maintained constant communications with government officials throughout the incident, and that third-party forensic investigations are still ongoing.
JBS USA Holdings ranks No. 57 on the Transport Topics Top 100 list of the largest private carriers in North America.
Want more news? Listen to today's daily briefing below or go here for more info:
