Singapore Marine Company Seemingly Hit by Clop Ransomware

It would seem that Singapore-based Swire Pacific Offshore, a company that provides offshore vessel services, has become the latest victim of ransomware.

Swire published an announcement, informing of an unspecified security incident recently. The company did not name the exact type of the attack and did not provide much detail, apart from the usual - that it has had no material effect on current operations and that it was being investigated.

However, as security researchers with SOS Intelligence reported, the name of Swire Pacific Offshore also showed up on the dark web page of the Clop ransomware gang, among the list of allegedly successful attacks that the hacker group had performed. Based on the proximity in time, it is not too much of a stretch to take the Clop ransomware gang boast to be true.

Swire is a large company and has significant annual revenues. The attack boast posted by Clop pegs Swire's revenues to be around $3 billion, so it would make sense that a company with this sort of income would make for a lucrative potential ransomware target.

According to Swire Pacific Offshore's report concerning the security incident, it resulted in the loss of a slice of confidential commercial information and "the loss of some personal data".

Swire has over 2000 employees and at this point, it is not clear what sort of personally identifiable data was illegally accessed and how many people were affected. According to security researchers, judging by the information published by the Clop ransomware gang, Swire data related to staff payroll, passports, and banking information, as well as email addresses may have been exfiltrated.

The attack brought down Swire's official website. It is very possible that other networks, including ones related to monitoring operations, were affected by the attack as well. The company has contacted all relevant authorities and has brought onboard security experts to help fix the situation and improve security in the future.

Even though a joint police operation in which both Ukrainian and South Korean authorities worked together to try and bring down the Clop ransomware gang in the summer of 2021, the criminal organization was back in business very briefly after six people believed to be Clop members were arrested.