Royal Mail working with cyber security agency on ransomware attack

The Royal Mail is working with the National Cyber Security Agency and the National Crime Agency to understand the full impact of a ransomware attack that disrupted the company’s overseas deliveries. 

Allegedly orchestrated using ‘Lockbit’ ransomware often used by Russian connected criminal gangs, according to the BBC, the attack was first revealed last week when Royal Mail warned customers not to send any international post until a ‘cyber-incident’ was resolved.

A statement on the Royal Mail website says: ‘We are temporarily unable to despatch items to overseas destinations. To support faster recovery when our service is restored and to prevent a build-up of export items in our network, we’re asking customers not to post international items until further notice. 

‘Items that have already been despatched may be subject to delays. We would like to sincerely apologise to impacted customers for any disruption this incident is causing.’ 

Import services are thought not to be largely affected aside from some ‘minor delays.’ 

Ransomware attacks encrypt the data of people or organisations and are usually used by hackers to demand payment in return for the decryption and return of information and data. 

Some reports have alleged that printers at one of the company’s distribution centres started printing copies of a message from the hackers which supposedly reads ‘your data are stolen and encrypted. You can contact us and decrypt one file for free.’ 

The National Cyber Security Centre is part of the UK’s intelligence agency, GCHQ, and released a statement saying: ‘“We are aware of an incident affecting Royal Mail Ltd and are working with the company, alongside the National Crime Agency, to fully understand the impact.’ 

This attack follows a recent report by the Department for Digital, Culture, Media and Sport which found that ‘cyber-incidents’ were prevalent among medium to large sized businesses and charities with 85% of them taking some sort of action to improve digital security.

Photo by Brett Jordan