Portugal's Impresa Media Giant Hit by Ransomware
While everyone was still celebrating the arrival of 2022 in the first hours of January 1, Portuguese media giant Impresa was hit by a cyberattack that involved ransomware. The aftermath of the attack was significant, as Impresa owns and operates television channels, both on-air and streaming, as well as a big media portal website and a newspaper.
Impresa is one of Portugal's largest media corporations and operates the largest collective media network in the country, among its TV channels, the newspaper, and website. The attack had a significant impact on the company and affected servers that were central to the company's operation.
There is no information disclosed on part of Impresa when it comes to the specifics of the ransom asked by the threat actor behind the attack. All that is known so far is that the entity behind the ransom attack is called Lapsus$.
Who is the Lapsus$ Gang?
Lapsus$ is the hacker collective that was also behind a recent attack against the Brazilian Ministry of Health. The ransom attack took place in December of last year and led to the data destruction of millions of health records of Brazilian citizens related to their Covid-19 vaccination status.
The ransomware group is not as infamous or as influential as the big names in the field, such as Darkside, REvil, or Conti. It seems Lapsus$ choose to focus their attacks on demographics that speak Portuguese, with the attack on Portugal's Impresa being the first successful attempt on part of Lapsus$ to compromise an entity in Portugal.
Hackers Flaunt Their Deed
Lapsus$ also compromised Impresa's website and took control of the company's official, verified Twitter account. The hackers used the latter to boast about their success and had their ransom note temporarily on the Impresa home page. This was remedied soon as the company regained control of the website and removed the defaced page, replacing it with a maintenance message.
It doesn't look like ransomware is going anywhere, with the very first hours of the new year marking yet another significant successful breach and ransomware hit. As security experts have been warning for a while now, despite a company's best efforts, there will likely always be a chink in the armor that threat actors can abuse.
