Some Toll Group systems offline after suspected cyber attack

guest · Feb 2, 2020

Some Toll Group systems offline after suspected cyber attack
January 31, 2020
https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12305031

Some systems are offline at transport and logistics company Toll Group following a "suspected cyber security incident."

A message posted to the Australian-owned company's website reads, "As a precautionary measure, Toll has made the decision to shut down a number of systems in response to a suspected cyber security incident.

"We are investigating the root cause to resolve the issue. Our immediate priority is to contain any potential impact to our customers and operations.
We expect several customer applications to be impacted throughout the day. We will continue to provide regular updates."
Click to expand...

guest · Feb 3, 2020

Toll deliveries have been missing all weekend, after a cyber attack shut down the company's systems and left customers unable to track their items
The company confirmed to Business Insider Australia its systems had been down since Friday, and it was unable to track or locate customer’s items
February 3, 2020
https://www.businessinsider.com.au/toll-hack-cyber-attack-deliveries-missing-tracking-error-2020-2

The situation is believed to affect operations across Australia, India and the Philippines, with the company unable to pinpoint where deliveries are currently located.
While declining to elaborate, the system shutdown has impacted several of Toll’s services, as well as its customer-facing applications, frustrating customers who have had to contend with the outage for days.

“[Four] calls later and I’ve [gotten] nowhere with locating the whereabouts of my package. I literally just want to know where I can pick it up,” one complained online.
“I’m in the same boat. They can’t even give me a list of shops I can check manually. I asked them to call the driver but they only communicate via their system. Looks like they have zero process in case of an IT outage. I’ve called them 5 times over the last 5 days,” another seconded.
While a Toll Group spokesperson claimed customers “remain at the forefront of Toll’s priorities”, they appear as if they’ve largely been left in the dark.

Several days later however and there’s no indication of when this all might be resolved. In the meantime, customers have been left in the lurch.
Click to expand...

guest · Feb 4, 2020

Toll Group tight-lipped on alleged ransomware attack
May have infected over 1000 servers
February 4, 2020
https://www.itnews.com.au/news/toll-group-tight-lipped-on-alleged-ransomware-attack-537437

Toll Group is staying tight-lipped on what appears to be a large-scale ransomware attack that has infected a sizable part of its IT infrastructure.

The logistics giant first reported that it was suffering from the effects of a “cyber security incident” on Friday last week.
That continued into this week with pickup and tracking systems, including its MyToll portal, offline.

A source with knowledge of the incident told iTnews that the company has been hit with a sizable ransomware infection that is impacting global operations.
The source said that over 1000 servers had been infected, and that staff worldwide had been told to leave desktops and laptops switched off and disconnected from the corporate network.
[...] Active Directory, productivity and corporate VPN applications were among those infected and taken offline.
Click to expand...

The company responded with a prepared statement that did not address any of the points.
It did not further respond to follow-up emails and calls made to several media representatives.
Click to expand...

Toll IT Systems Update (February 4, 2020)

As a result of our decision to disable certain systems following a recent cyber security threat, we’re continuing to meet the needs of many of our customers through a combination of manual and automated processes across our global operations, although some are experiencing delay or disruption.

We can confirm the cyber security incident is due to a targeted ransomware attack which led to our decision to immediately isolate and disable some systems in order to limit the spread of the attack. At this stage, we have seen no evidence to suggest any personal data has been lost. We’re continuing to undertake a thorough investigation and we’re working around the clock to restore normal services at the earliest opportunity. We’ll continue to provide updates as we securely bring our systems back online.
Click to expand...

guest · Feb 6, 2020

Toll Group recovers after ransomware attack
Company resorts to manual processes
February 6, 2020
https://ia.acs.org.au/article/2020/toll-group-recovers-after-ransomware-attack.html

Australian courier and logistics company, Toll Group, is gradually returning to its usual operations after a ransomware attack devastated its IT systems late last week.

The transportation company confirmed that it was infected by a strain of the Mailto ransomware and has shared samples of the malicious software with “law enforcement, the Australian Cyber Security Centre, and cyber security organisations” to help identify and limit the potential of future infections.

The company also said there has “no indication that any personal data has been lost” in the attack but it has not yet explained how the ransomware came to infect its systems.
Toll has no intention of paying the ransom, according to the Australian Financial Review.
Click to expand...

The attack on Toll is the first known case of Mailto/Netwalker taking on enterprise-level systems.
Click to expand...

Australian Financial Review: Toll refuses to pay hackers' ransom, works to restore crippled systems

Logistics company Toll Group will not pay a ransom to unlock its crippled systems and said it was gradually restoring operations to normal after identifying that cyber criminals came after it with a new form of malware.
A company spokesperson declined to comment on the potential identity of the hackers or the size of ransom being demanded.
Click to expand...

Toll IT Systems Update (February 6, 2020)

6 February 2.30pm AEDT
As we work through our IT recovery plan in response to the recent cyber-attack, our focus is on restoring the relevant underlying infrastructure and fully-automated systems, and on conducting a thorough review of the affected IT hardware including servers, systems and devices. In doing so, we are working closely with our cyber security advisers to ensure that any risk associated with this incident has been appropriately managed and neutralised.
Click to expand...

guest · Feb 18, 2020

Australian Transportation Company Is Still Battling Ransomware Infection 18 Days Later
February 18, 2020
https://hotforsecurity.bitdefender....ransomware-infection-18-days-later-22344.html

18 days after the Australian transportation firm Toll was crippled by ransomware, the company is still suffering problems, and the attack continues to impact its customers. It shows that the cost of ransomware is often much higher than the ransom requested by the attackers.

Following the attack, Toll started the difficult work of restoring the systems, but the bigger the company, the more complex the infrastructure. The company’s clients were the first impacted, and an AFR report says that Officeworks, Unilever, Adidas, and Nike are among organizations affected.

“We now have many of our customers back online and operating essentially as normal, including through large parts of our global cargo forwarding network and across our logistics warehouse operations around the world,” said a Toll spokesperson for NZME.
Toll has yet to provide a timeline for the restoration of services, and it’s not difficult to see why.
Click to expand...

guest · May 5, 2020

Toll Group hit by ransomware a second time, deliveries affected
May 5, 2020
https://www.bleepingcomputer.com/ne...ransomware-a-second-time-deliveries-affected/

The Toll Group has suffered its second ransomware cyberattack in three months, with the latest one conducted by the operators of the Nefilim Ransomware.
A second attack by the Nefilim ransomware
In an announcement today, Toll Group states that they have suffered another attack that has caused them to shut down their systems again. This time the cyberattack was conducted by the operators of the Nefilim Ransomware.

While the Toll Group states that there is no evidence of any data being stolen, Nefilim is known for stealing unencrypted files and using it as leverage to get victims to pay the ransom.
Click to expand...

Shut down impacting deliveries
In a tweet posted by Toll Group, they state that they have had to shut down their "MyToll" shipping portal customer site as part of their defense against the ransomware attack.

In reply to the tweet, customers have stated that their deliveries have been impacted as without MyToll they are unable to redirect shipments to another collection center.
Click to expand...

guest · May 7, 2020

Toll services to remain offline all week after second hack
May 6, 2020
https://www.afr.com/technology/toll...e-all-week-after-systems-hack-20200506-p54qhh

Embattled logistics giant Toll Group has told clients they will be without most of their online systems for at least the rest of the week, as it tries to securely restore its systems following a ransomware cyber attack.

In a statement on Wednesday afternoon Toll said it was making good progress in rebuilding the core systems which underpin most its online operations, while it continued to investigate the details of the ransomware attack.
Parcel tracking and tracing through its MyToll portal is still not available, as staff manually sort parcels in its operation centres and the systems needed to record movement of parcels remain offline.
Click to expand...

Due to its essential role in shipping healthcare supplies and also grocery essentials for major supermarkets, security expert James Turner of CISO Lens said the attack strayed close to the kind of cyber warfare issue where government could become involved in responding aggressively.

"I think that this attack highlights that there's a national security aspect to tolerating strategically important companies being singled out and taken down by criminals," Mr Turner said.
Click to expand...

guest · May 12, 2020

Shipping Giant Toll Confirms Hackers Stole Data in Recent Attack
May 12, 2020
https://www.securityweek.com/shipping-giant-toll-confirms-hackers-stole-data-recent-attack

Toll informed customers last week that it had shut down some IT systems after discovering a piece of ransomware. This was the second ransomware incident disclosed by the company this year.

In an update shared on Tuesday, Toll admitted that the hackers did gain access to a corporate server from which they downloaded some information. The affected server stored information on current and former employees and details on commercial agreements with enterprise customers. However, the company said customer operational data was not exposed.

“At this stage, we have determined that the attacker has downloaded some data stored on the corporate server, and we are in the process of identifying the specific nature of that information. The attacker is known to publish stolen data to the ‘dark web’. This means that, to our knowledge, information is not readily accessible through conventional online platforms,” Toll said in a statement.
Click to expand...

guest · May 20, 2020

Toll's stolen data finds itself on the 'dark web'
May 21, 2020
https://www.zdnet.com/article/tolls-stolen-data-finds-itself-on-the-dark-web/

Toll Group has provided an update on the ransomware attack it suffered following a January infection.

The Australian transport giant said, after revealing the extent of data theft it suffered earlier this month, that the stolen information has found its way onto the "dark web".

"Following our announcement last week that a ransomware attacker had stolen data contained on at least one Toll corporate server, our ongoing investigation has established that the attacker has now published to the dark web some of the information that was stolen from that server," Toll wrote in an update.
Click to expand...

Earlier this month, Toll said the attacker behind the theft was known to publish stolen data to the dark web.

"This means that, to our knowledge, information is not readily accessible through conventional online platforms," Toll said at the time.
The company said it was focused on assessing and verifying the specific nature of the stolen data that has been published.
Click to expand...

Toll IT Systems Update (May 20, 2020)

20 May 2020, 5PM AEDT
Following our announcement last week that a ransomware attacker had stolen data contained on at least one Toll corporate server, our ongoing investigation has established that the attacker has now published to the dark web some of the information that was stolen from that server. As a result, we are now focused on assessing and verifying the specific nature of the stolen data that has been published. As this assessment progresses, we will notify any impacted parties as a matter of priority and offer appropriate support.
Click to expand...

guest · May 28, 2020

Toll Group confirms attackers 'accessed' personal and payroll data of staff
Toll IT systems update (May 28, 2020)

28 May 2020, 4PM AEDT
Following confirmation recently that the ransomware attackers had accessed Toll corporate server files which contain information relating to past and present employees, we have established that the information includes details such as name, residential address, age or birthdate, and payroll information (including salary, superannuation and tax file number).

The information relates to some current and former employees in certain countries in which Toll operates, including Australia and New Zealand. The incident does not affect all Toll employees and, based on current findings, casual staff are not impacted.
There is no evidence at this stage that the information in question has been taken.
Click to expand...

guest · Jul 5, 2020

Third batch of Toll documents leaked online after Windows ransomware attack
July 4, 2020
https://www.itwire.com/security/thi...d-online-after-windows-ransomware-attack.html

[...] A screenshot of the announcement about the Toll documents on the dark web.
It appears that the company, a huge business, had pretty good back-ups as there has been no sign of any communication with the attackers.

The second lot of documents related to Toll's dealings with Samsung, the South Korean conglomerate, and were posted on 5 June.
There were two links that time too, one being a text file that listed the names of the documents. The second, coming in at 4.6 gigabytes, included the documents themselves.
Click to expand...

Contacted for comment, a Toll spokesperson said: "We're aware that certain information has been published to the dark web. We're investigating the precise nature of the information, with the support of our cyber security partners. We continue to work closely with relevant federal authorities on the matter."
Click to expand...

Log in or Sign up

Some Toll Group systems offline after suspected cyber attack

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Some Toll Group systems offline after suspected cyber attack

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches