Insurance company CNA Finance reportedly paid $40M to resolve ransomware attack

Ransomware attacks are nearly daily news in 2021 and there’s a reason why: It’s a lucrative business for cybercriminals who know that even if some of their targets won’t pay up, others will.

Enter a ransomware attack on insurance company CNA Finance Corp. in March. At the time, the company only said that it was targeted by a “sophisticated cybersecurity attack.” Although it didn’t disclose that the attack was ransomware, it was suggested that it had been a victim.

Now it seems that CNA paid a whopping $40 million ransom in response to the “cyberattack,” which was always a ransomware attack. Bloomberg reported that CNA paid the ransom about two weeks after the attack that included a trove of their data being stolen as well.

CNA said in a statement that the company followed the law and that it had consulted and shared intelligence about the attack with the U.S. Federal Bureau of Investigation and the Treasury Department’s Office of Foreign Assets Control. The Treasury Department said in October that paying ransomware demands may be illegal and that companies that do so could be prosecuted.

“CNA is not commenting on the ransom,” a spokesperson for CNA told Bloomberg. “CNA followed all laws, regulations and published guidance, including OFAC’s 2020 ransomware guidance, in its handling of this matter.”

In a security incident update published May 12, CNA said that it had been working diligently with outside experts to determine what happened during the course of the attack. The company noted that “as a result of our efforts, we are confident that the threat actor has not accessed the CNA environment since the ransomware event.”

At the time of the initial ransomware attack on CNA, it was reported that it might have involved the REvil ransomware gang. Bloomberg, however, said it involved malware called Phoenix Locker, sometimes also called “Hades,” that is linked to the hacking group Evil Corp.

Bleeping Computer reported in March that Evil Corp had switched to using Hades as a way to evade sanctions imposed by the Treasury Department’s Office of Foreign Assets Control. Given that CNA has allegedly paid up, the text is fitting.

“The U.S. Treasury Department sanctioned Evil Corp gang members in December 2019 after being charged for using Dridex to cause over $100 million in financial damages,” Bleeping Computer wrote. “Because of this, their victims face a tricky situation if they want to pay Evil Corp’s ransom as they would also violate the sanctions.”

How Hades bypasses sanctions is not clear.

Photo: RHok Chicago/Flickr

Since you’re here …

Show your support for our mission with our one-click subscription to our YouTube channel (below). The more subscribers we have, the more YouTube will suggest relevant enterprise and emerging technology content to you. Thanks!

Support our mission:    >>>>>>  SUBSCRIBE NOW >>>>>>  to our YouTube channel.

… We’d also like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.

If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.