Russian-speaking hackers have demanded US$70mln worth of Bitcoin in a mass ransomware attack.
Over 200 companies worldwide were asked for money to have their data restored. The disruption occurred on Friday.
READ: Ransomware is most dangerous threat for UK companies, authorities say
"We launched an attack on MSP providers. More than a million systems were infected. If anyone wants to negotiate about universal decryptor - our price is 70 000 000$ in BTC and we will publish publicly decryptor,” a blog used by REvil, a major Russian-speaking ransomware group, posted on Sunday.
The hackers first infiltrated in Kaseya, an information technology firm, then accessed hundreds of its clients’ data. The chain reaction reached Swedish grocery stores, schools in New Zealand and two Dutch IT firms among others.
It is believed they chose 4 July because fewer people are working as it is a public holiday in the US.
“The FBI is investigating this situation and working with Kaseya, in coordination with CISA, to conduct outreach to possibly impacted victims. We encourage all who might be affected to employ the recommended mitigations and for users to follow Kaseya's guidance to shut down VSA servers immediately,” the FBI said.
President Joe Biden said on Saturday it is not clear who is behind the breach but he “will respond” if it is connected to Russian President Vladimir Putin.
Ciaran Martin, founder of the UK's National Cyber Security Centre, told Radio 4 the scale and sophistication of this cybercrime were “rare, if not unprecedented”.
A ransomware attack is when hackers demand payment or otherwise they will cause disruption or delete files.
Usually, victims unknowingly download malicious software that prevents them from accessing files, systems or networks.
JBS, the world’s largest meat supplier, and US fuel company Colonial Pipeline were recently targeted by such attacks.
The FBI previously said companies shouldn’t pay attackers as it doesn’t guarantee it will get the data back.
“Ransomware is a growing, global cyber threat, and all organisations should take immediate steps to limit risk and follow our advice on how to put in place robust defences to protect their networks,” said the UK's National Cyber Security Centre.