London Drugs ransom demand resurfaces after vanishing hours before deadline
Posted May 23, 2024 9:08 am.
Last Updated May 23, 2024 12:55 pm.
The ransomware group that targeted London Drugs relisted its ransom demand Thursday after the demand vanished from its dark web site just hours before its original deadline.
According to Emsisoft cyber threat analyst Brett Callow, the demand was relisted with an updated deadline of Thursday, May 23, “19:56:38 UTC” — 12:56 p.m. PST.
CLICK HERE TO LISTEN TO CITYNEWS 1130 LIVE!Lockbit, the perpetrators claiming to be behind the ransom, have been demanding that London Drugs pay $25 million in exchange for data stolen during the April cyberattack that shuttered stores for days.
The ransomware group has been threatening to leak employee information on the dark web if those demands are not met.
Speaking to CityNews Thursday, Callow says in similar cases he has seen, the removal and then relisting of the demand could indicate “the victim company entered negotiations, and those negotiations then fell through.”
“It should be noted, however, that simply because a company enters negotiations, or makes an offer, as LockBit claimed that London Drugs did, it doesn’t mean there was ever an intention to pay,” he explained.
Callow says companies sometimes engage in negotiations to delay the release of any data, and to give more time to law enforcement agencies to allow them to intervene.
However, he won’t be shocked if the ransom disappears from the Russian hackers’ site again sometime soon.
“I wouldn’t be at all surprised, however, if that deadline were to be pushed back or if London Drugs were to disappear from the site, again, perhaps temporarily.
“The ransomware operators do not want to release data in these cases, because that means they’ve lost — they’re not going to get any money from the attack. So, that is a last-ditch step that’s simply done as a warning to future victims.”
You can watch CityNews 24/7 live or listen live to CityNews 1130 to keep up to date with this developing story. You can also subscribe to breaking news alerts sent directly to your inbox.
–With files from Mike Lloyd
