Travelex Trapped by Ransomware
Travelex, the London-headquartered foreign exchange company is being held to ransom by a gang of cybercriminals. According to a report by the BBC, the Travelex network was paralysed by hackers on 31 December 2019. The gang, with the moniker Sodinokibi, revealed to the BBC that it wants the finance company to cough up £4.6 million. Sodinokibi, also known as REvil, will then, and only then, to release 5GB of sensitive customer data that it downloaded and stole.
As a preventative measure, Travelex has taken down its websites in 30 countries in order to protect data and contain ransomware.
What REvil Say
The hackers can be quoted as saying:
“In the case of payment, we will delete and will not use that data and restore the entire network.
“The deadline for doubling the payment is two days. Then another seven days and the sale of the entire base.”
GDPR Consequences
The Information Commissioners Office (ICO) categorically states that Travelex has not reported the data breach. The ICO upholds the information rights in the public interest and handles all UK data protection issues including GDPR compliance. By law, organisations must notify
the ICO of a personal data breach within 72 hours unless it does not pose a risk to people’s rights and freedoms. Under the GDPR ruling, a company that exhibits data protection non-compliance can be fined €20 million or 4% of annual global turnover, whichever is greater.
Offline for 10 Days
Since 31 December 2019, Travelex websites in the United States, Europe and Asia have been offline with a message on the homepage stating:
“We’re sorry but our online travel money service isn’t available right now.
This is as a result of a software virus. On discovering the virus, and as a precautionary measure, Travelex immediately took all its systems offline to prevent the spread of the virus further across the network.
Whilst the investigation is still ongoing, to date our investigation shows that customer data has not been compromised.”
Buy Your Money Offline
Customers can only contact Travelex via social media. As a result of the breach, Virgin Money and Sainsbury’s Bank, which partner with Travelex, are also unable to offer online travel money services. And, if you want to buy money from Travelex, you’ll need to find your nearest High Street store.
