Travelex, the world's largest foreign currency specialist company, a financial services company with a range of payment and currency brands, was infected by a ransomware recently.
According to third-party reports, some cybercriminals launched this malware and demand a cash payment of 3 million dollars.
Due to the delay in payment, the criminals have already published around 300MB of customer data, including their full name, social security number, birth dates and payment card information.
This situation has forced all UK branches to reject online currency exchange requests, if customers need to carry out such a transaction, they will have to appear physically at the bank.
It is known that the ransomware used is the “Sodinokibi (REvil)” for which the code needed to decrypt it has not yet been discovered. Travelex has chosen to leave a message for website visitors indicating that online services will be operational shortly, due to a “planned maintenance”.
We conclude this news with Kevin Beaumont's observations where he indicates that the company's AWS platform had servers with RDP enabled for the Internet and NLA (network location service) disabled. Asimismo, reported that Travelex had insecure VPN connections.