Meat-processing provider JBS says it paid a group of ransomware hackers $11 million in bitcoin, despite largely recovering from the attack.
The ransomware struck on Sunday, May 30 and led to a temporary shutdown of several JBS meat-processing plants in the US. Although the company managed to mostly restore IT operations within days, JBS still elected to pay the ransom over concerns the hackers might sell or possibly leak company data “exfiltrated” from the attack.
“This was a very difficult decision to make for our company and for me personally,” said JBS USA CEO Andre Nogueira in a statement. “However, we felt this decision had to be made to prevent any potential risk for our customers.”
The news is another depressing sign that ransomware hackers continue to win. The attacks work by infecting whole fleets of computers and encrypting the information inside. To free the computers, victims have to pay the hackers in Bitcoin.
In JBS’s case, the company was able to quickly mitigate the attack, thanks to “redundant systems and encrypted backup servers”—a key strategy to stopping a ransomware outbreak.
However, the hacking group behind the attack, REvil, is notorious for also leaking confidential data stolen in ransomware attacks. In April, the group struck an Apple supplier, and began publicizing files on MacBook designs.
In determining to pay the attackers, JBS said it consulted both the company’s internal IT team and third-party cybersecurity experts. The ransomware payout is among the highest publicly known. The current record holder is a $40 million payment insurance firm CNA Financial group allegedly sent to a ransomware group in March, according to Bloomberg.
JBS says it's been in constant communication with US government officials over the attack. So it’s possible the FBI is working to intervene. Earlier this week, the Justice Department announced it had seized $2.3 million in bitcoin sent to the hacking group DarkSide after its ransomware struck fuel provider Colonial Pipeline.