Sopra Steria Confirms Being Hit by Ryuk Ransomware Attack

French enterprise IT services company Sopra Steria confirmed today that they were hit with a Ryuk ransomware attack.

Sopra Steria is a European information technology company with 46,000 employees in 25 countries worldwide. The company provides a wide range of IT services, including consulting, systems integration, and software development.

On October 21st, Sopra Steria stated that they were hit with a cyberattack but did not provide any further details.

“A cyberattack has been detected on Sopra Steria’s IT network on the evening of 20th October. Security measures have been implemented in order to contain risks.”

French media and BleepingComputer were told at the time that the company was hit with a Ryuk ransomware attack after previously being infected with either TrickBot or BazarLoader.

Both malware infections are created by the same hacking group and provide remote access to the threat actors behind Ryuk Ransomware. This access allows the attackers to compromise a network further and ultimately deploy the ransomware throughout the company’s devices.

Today, Sopra Steria issued a statement confirming that they were affected by the Ryuk Ransomware.  As part of their investigation, it was determined that the attackers compromised their network over the weekend and then deployed the ransomware on October 20th.

Also Read: PDPA Breach Penalty Singapore: How Can Businesses Prevent

“The virus has been identified: it is a new version of the Ryuk ransomware, previously unknown to antivirus software providers and security agencies.”

“Sopra Steria’s investigation teams immediately provided the competent authorities with all information required. The Group was able to quickly make this new version’s virus signature available to all antivirus software providers, in order for them to update their antivirus software.”

“Moreover, it has also been established that the cyberattack was only launched a few days before it was detected,” Sopra Steria confirmed in a statement sent to BleepingComputer.

Sopra Steria further states that their investigation does not indicate that any customer data was leaked at this time.

The company has started restoring devices and anticipates it taking a few weeks before the company is fully operational.

Also Read: The Importance Of Knowing Personal Data Protection Regulations