What happened
In May 2020 the logistics company Toll Group was hit by the Nefilim ransomware — its second ransomware incident that year. Toll confirmed the attacker had downloaded data from a corporate server, including personal information of past and present employees and details of commercial agreements with some enterprise customers [toll-itnews]. Toll said it would not pay the ransom [toll-itnews], and later confirmed that the attacker had published some of the information that was stolen on the dark web, while it was still assessing what that information was [toll-acs]. In a later update Toll said the employee data included names, residential addresses, age or birthdate, and payroll information including salary, superannuation and tax file numbers [toll-itnews-payroll].
Timeline
- 2020-05-12 — Nefilim ransomware attack reported; Toll confirmed data had been downloaded from a corporate server [toll-itnews].
- 2020-05-21 — Toll confirmed some stolen information had been published on the dark web [toll-acs].
- 2020-05-28 — Toll confirmed the attackers accessed personal and payroll data of staff [toll-itnews-payroll].
Current status
Disclosed. Toll did not publish a count of affected individuals, so no figure is asserted here. No regulator notification or action has been found in the sources. Figures and data types are as reported by the company and credible media [toll-itnews], [toll-acs], [toll-itnews-payroll].
Why it matters
A major trans-Tasman logistics operator, hit twice in one year, with confirmed exfiltration and dark-web publication of stolen data — an early, high-profile example of double-extortion ransomware in the region.