Wearables and navigation company Garmin suffered a global outage that took down its Garmin Connect fitness platform, flyGarmin aviation service, website, and call centres. Media reports and researchers attributed the outage to WastedLocker ransomware.
What happened
- The outage began late on 22 July 2020 and lasted several days.
- Garmin later confirmed it had been the victim of a cyber attack that encrypted some of its systems, and said it had no indication customer data had been stolen.
- Researchers linked WastedLocker to the Russia-based group Evil Corp, whose alleged members had been sanctioned by the US Treasury in 2019.
- Reports said the attackers demanded around US$10 million; Garmin did not comment on any payment.
Why it mattered
The attack affected millions of consumers and pilots, and highlighted the legal risk for victims considering payments to sanctioned groups. It also showed how the failure of one company’s cloud platform can disrupt connected devices and services that customers rely on every day.
Lessons for organisations
Segment networks to limit how far ransomware can spread, keep offline backups, and take legal advice on sanctions before any decision about ransom payments. Prepare customer communications in advance so that people are kept informed during a lengthy outage.
Source: TechCrunch
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
