Insurance Firm CNA Pays $40m To Ransomware Criminals

Tom Jowitt,
Pile of money in the form of US dollars

When it will end? One of the largest insurance firms in the United States has reportedly paid hackers a staggering $40 million ransom

The ransomware scourge continues to bring in lucrative returns for the criminal gangs operating the cyberattacks, according to a recent report.

According to Bloomberg, CNA Financial, one of the largest US insurance companies, paid $40 million to free itself from a ransomware attack that occurred in March.

The hackers stole data from the Chicago-based insurance giant, and initially demanded a $60 million ransom. Bloomberg reported that negotiations started about a week after some of CNA’s systems were encrypted, and the insurance company paid the ‘lower sum’ of $40 million a week later.

Huge payout

If this $40 million ransomware pay out is confirmed, it will be one of the world’s highest ransom payouts that has been publicly disclosed.

It should be noted ransomware demands in the millions is not unusual.

Apple and Acer had data compromised earlier this year, and each were asked for a $50 million ransom.

For its part, CNA told Bloomberg that it wouldn’t comment on the ransom, but that it had “followed all laws, regulations, and published guidance, including OFAC’s 2020 ransomware guidance, in its handling of this matter.”

In an update from 12 May, CNA reportedly said it believes its policyholders’ data was unaffected.

According to Bloomberg, the ransomware that locked CNA’s systems was Phoenix Locker, a derivative of another piece of malware called Hades.

Hades was allegedly created by the Russia-based gang Evil Corp.

Earlier this month British Foreign Secretary Dominic Raab warned Russia that it cannot continue to shelter criminal gangs carrying out ransomware attacks on Western nations.

Colonial pipeline

Another major ransomware hack took place this month when Colonial Pipeline was attacked by DarkSide, causing widespread fuel shortages on the US east coast.

Indeed, so serious was the attack that the US government engaged emergency powers and US President Joe Biden received “personal briefings” about the cyberattack.

The Colonial Pipeline runs between Texas and New Jersey and is 5,500 mile long.

It was soon reported that Colonial Pipeline had paid DarkSide $5 million in ransom, but CEO Joseph Blount later admitted paying DarkSide a ransom of $4.4 million.