More than a dozen UK banks have lost their online foreign currency services because of a ransomware attack on Travelex. RBS, Sainsbury’s Bank, First Direct, Virgin Money and Barclays are among them. Many are handling currency requests in branches instead.
Travelex pulled all its systems offline after being hit on December 31. At first it described the problem as a “software virus”. On January 7 it named the culprit: a ransomware strain called Sodinokibi, also known as REvil.
The company says the malware has been contained. It has not resumed normal operations, though some internal systems are working again. For now, chief executive Tony D’Souza said, Travelex “continues to offer services to its customers on a manual basis.”
The ransom and the data
The BBC reported that the attackers are trying to extort $6m from Travelex by encrypting its data. Travelex has said it is not yet clear what was affected. In its January 7 statement it said there had been “some data encryption” but “no evidence that structured personal customer data has been encrypted.” It added that it did not have a full picture of what was encrypted, and still saw no sign that any data had been taken.
A missing report
Organizations in the UK have 72 hours to tell the Information Commissioner’s Office once they know of a data breach. On Tuesday the ICO said it had received no breach report from Travelex.
