News / Toll refuses to pay cyber ransom as it acts to get its systems back online

05/02/2020

Australian 3PL Toll Group is continuing to work on recovering its IT platform, crippled by a ransomware cyber attack last Friday.

It said the virus, which caused its systems to crash, has been identified as a variant of Mailto ransomware.

“We have shared samples of the malware with law enforcement, the Australian Cyber Security Centre and cyber security organisations to ensure the wider community is protected,” Toll said today.

According to a report in the Australian Financial Review, Toll has refused to pay the ransom demanded by hackers, instead focusing on restoring operations to normal, and claimed its parcel and e-commerce shippers and freight forwarding customers were increasingly seeing operations return to “usual levels”.

“As part of the roll-out of business continuity measures in response to the recent cyber-attack, many of our customers are now able to access our services across large parts of the network globally, including freight, parcels, warehousing and logistics and forwarding operations.

“Based on a combination of automated and manual processes instituted in place of the affected IT systems, freight volumes are returning to usual levels. We have also increased staffing at our contact centres to assist with customer service.

“Notwithstanding the fact services are being provided largely as normal, some customers are experiencing delays or disruption and we’re working to address these issues as we focus on bringing our regular IT systems back online securely,” it said.

However, cyber security sources questioned Toll’s claim that there was “no evidence to suggest any personal data has been lost”.

“Absence of proof ain’t proof of absence, as the saying goes. They wouldn’t be the first company to say that and then be proved wrong,” one said, pointing to previous attacks where it later transpired that sensitive information had been stolen.

“Multiple groups now routinely steal data and use the threat of it being posted online as additional leverage to extort payment.

“To be clear, I have no reason to believe that the Toll’s data was stolen, I’m simply pointing out that organisations’ initial assessments are not always right,” he added.