Travelex website was hit by Sodinokibi ransomware

(Image credit: / ymgerman)

Travelex has confirmed that a major cyberattack that took its business offline last week was caused by ransomware.

The foreign exchange giant has revealed it was hit by the notorious Sodinikibi ransomware in an attack on New Year's Eve, with the criminals behind the attack demanding a $6m payment to restore stolen files.

Travelex was forced to take down its websites in 30 countries in an attempt to try and control the attack, with customers across Europe, Asia and the US still unable to gain online access to their accounts.


The group behind the attack, known as REvil, claim to have gained access to Travelex's network six months ago. 

REvil says it has a 5GB stash of downloaded information from the company, including customer dates of birth, credit card information and national insurance numbers.

"In the case of payment, we will delete and will not use that (data)base and restore them the entire network," the group said in a statement.

"The deadline for doubling the payment is two days. Then another seven days and the sale of the entire base."

Travelex may be set to face further punishment after the ICO revealed it had not received a data breach notice from the company. Under GDPR legislation, organisations must notify the ICO within 72 hours - unless the breach is deemed not to pose a risk to people's rights and freedoms.

Failure to comply could cost Travelex millions in fines, with the ICO able to issue a fine of four percent of an offender's global turnover.

"If an organisation decides that a breach doesn't need to be reported, they should keep their own record of it and be able to explain why it wasn't reported if necessary," the ICO added.

Travelex says it is working with the Metropolitan Police alongside its own teams of IT specialists and external cyber-security experts to investigate the attack.

"On Thursday, 2 January, the Met's Cyber Crime Team were contacted with regards to a reported ransomware attack involving a foreign currency exchange," the Met said in a statement. "Inquiries into the circumstances are ongoing."


Mike Moore
Deputy Editor, TechRadar Pro

Mike Moore is Deputy Editor at TechRadar Pro. He has worked as a B2B and B2C tech journalist for nearly a decade, including at one of the UK's leading national newspapers and fellow Future title ITProPortal, and when he's not keeping track of all the latest enterprise and workplace trends, can most likely be found watching, following or taking part in some kind of sport.