Toyota finance department hit by ransomware attack, ransom demands $8 million
Toyota Financial Services - a subsidiary of Toyota, has just officially announced that it was attacked by hackers and is working to restore the system to operation.
Toyota Financial Services (TFS) has officially confirmed the detection of “unauthorized intrusion activity on its systems” in a limited number of locations.
In response to the security incident, the company took the affected systems offline and launched an investigation with the help of law enforcement.
TFS is the financial division of Toyota Motor Corporation (Japan). This is a subsidiary of Toyota that provides a variety of financial services to Toyota customers and dealers worldwide.
TFS offers a variety of financial products, including auto loans, leasing and insurance solutions. Services offered by Toyota Financial Services may vary by region and customers can access these services through Toyota dealerships or online platforms.
On November 16, the Medusa hacker group claimed responsibility for the attack and threatened to leak the stolen data if TFS did not pay the ransom.
Medusa is demanding that TFS pay $8 million by November 26 to delete the company's stolen data, while offering the option to extend the payment deadline for an additional $10,000/day.
As evidence of the hack, Medusa released a sample of the stolen data. The stolen data included financial documents, invoices, account passwords, passport scans, etc. The documents were in German, suggesting they may have been stolen from the company's systems in Germany.
Renowned cybersecurity expert Kevin Beaumont believes that TFS's German office may have been hit by hackers exploiting the Citrix Bleed vulnerability to gain initial access to the company's network.
This incident continues to sound the alarm about the increasingly serious ransomware attacks on online information storage systems.