Business Continuity Management / Disaster Recovery , Fraud Management & Cybercrime , Governance & Risk Management

ATM Manufacturer Diebold Nixdorf Hit With Ransomware

Company Says April Attack Caused 'Limited IT Systems Outage'
ATM Manufacturer Diebold Nixdorf Hit With Ransomware

Diebold Nixdorf, one of the largest makers of ATMs, says it sustained a ransomware attack on April 25, but it reports that it experienced only a "limited IT systems outage" and ATM machines were not affected.

See Also: Every Second Counts: 6-Step Ransomware Remediation Guide

The company, law enforcement officials and a third-party security firm are continuing an investigation, a spokesperson for the North Canton, Ohio-based firm tells Information Security Media Group.

"Our company recently experienced a limited IT systems outage caused by a ransomware attack," the spokesperson tells ISMG. "Once we discovered the issue, we quickly restored service to key affected systems. We also immediately engaged a leading cybersecurity firm and informed law enforcement. The incident did not affect ATMs, customer networks, or the general public, and its impact was not material to our business."

Diebold Nixdorf, which sells ATMs as well as point-of-sale devices, physical security products and software used by retail and financial firms, declined to offer more details, including the ransomware strain involved, whether any data was encrypted and whether the company had been in communications with the attackers.

Services Affected?

Security blogger Brian Krebs first reported the ransomware attack on Monday. Citing a source, Krebs reports that the while the attack was contained by the Diebold Nixdorf’s IT and security teams, the ransomware attack affected services for about 100 of its customers.

Krebs also reports that the company was hit by a ransomware strain called ProLock, which is more often referred to as PwndLocker.

The PwndLocker crypto-locking malware was first spotted by security researchers in late 2019, and its operators have hit victims ranging from an Illinois county to a Serbian city. It's been reported that the gang's ransom demands have ranged from $175,000 to more than $660,000, with payment requested in bitcoin (see: PwndLocker: Free Decryptor Frees Crypto-Locked Data).

In March, the operators of PwndLocker changed the name of their malware to ProLock after security firm Emsisoft released a free decryptor tool to help victims unlock their files and recover their data.

Krebs reports that Diebold Nixdorf did not pay a ransom. Fabian Wosar, Emsisoft's CTO, tells ISMG refusing to pay a ransom is the right decision because the cybercriminals’ decryptor tool does not work as advertised and will only cause more issues for a company after the ransom is paid and the victim receives the decryption key.

"That's because current versions of ProLock’s decryptor tool will corrupt larger files such as database files," Wosar says.

Other Attacks

In another recent ransomware attack, mailing equipment manufacturer Pitney Bowes disclosed that it was recently targeted by the operators behind Maze variant (see: Pitney Bowes Battles Second Ransomware Attack)

And the Texas Office of Court Administration, which provides IT support for appellate courts and state judicial agencies within the Texas Judicial Branch, announced that a ransomware attack forced the staff to disable the branch network, including websites and servers, to stop the malware from spreading. This incident remains under investigation, although officials do not believe that any sensitive data was compromised.

Managing Editor Scott Ferguson contributed to this report.

About the Author

Ishita Chigilli Palli

Ishita Chigilli Palli

Senior Correspondent, Global News Desk

As senior correspondent for Information Security Media Group's global news desk, Ishita covers news worldwide. She previously worked at Thomson Reuters, where she specialized in reporting breaking news stories on a variety of topics.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.