Termite ransomware gang claims data theft at Blue Yonder

Members of the Termite ransomware operation claim to be responsible for the attack on the software-as-a-service (SaaS) company Blue Yonder.

On November 21, Blue Yonder experienced disruptions to its ‘managed services hosted environment’. Researchers found out that hackers had infiltrated the company’s computer network and used ransomware to encrypt and steal some of its files.

The company said it immediately had implemented additional security measures to harden its digital defenses and minimize the impact of the incident.

“We are making good progress, several of our impacted customers have been brought back online, and we are actively working directly with others to return them to normal business operations,” the company said in a statement at the time.

Earlier this month the software developer stated it was slowly, but steadily recovering from the ransomware attack.

Meanwhile, it remained unclear who was responsible for the data breach. Almost three weeks after the incident we finally have an answer to that question.

According to Hackmanac, a ransomware gang called Termite has claimed responsibility for the attack on Blue Yonder.

On their leak site, the ransomware operation claims to have stolen 680 gigabytes of corporate data, including databases, reports, insurance documents, over 200,000 miscellaneous documents, and email lists “for future attacks” (over 16,000 entries). The gang threatens to publish data links to the public ‘soon’.

In its latest update, Blue Yonder says it’s aware of the claims that Termite has made, but won’t confirm them. “We are working diligently with external cybersecurity experts to address these claims. The investigation remains ongoing,” he company says.

Over the past few weeks, several high-end clients confirmed they were affected by the ransomware attack, including Starbucks, Morrisons and Sainsbury (two big grocery chains in the United Kingdom), BIC (French pen manufacturer), Hema (Dutch retailer) and Jumbo (Dutch supermarket chain).

According to threat intelligence agency Cyjax, Termite is a ransomware gang that surfaced somewhere mid-October and made victims in Canada, France, Germany, Oman and the United States. Like other ransomware gangs, Termite is involved in data theft, extortion and encryption.