Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ransomware attack affecting Tietoevry's services to some customers in Sweden

tietoevry.com

Post reply on HN
Print view View original

11–20 of 22 posts

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#11

Post by qxfys »

zyberzero wrote: post #6
gerikson wrote: post #4

Earlier quoted context omitted.

Granngården is another.

Yeah, and parts of Vellinge Kommun as well. Apparently a lot of their day-to-day-systems are affected [0]. Also, a HR system called primula is affected. It is mostly used by universities from what I can gather. [0] = https://www.dn.se/sverige/it-attacken-paverkar-myndigheter-o... (Swedish, one of the biggest newspaper in Sweden)

lol yeah. Primula is affected. So no one can apply for vacation, business travel, reimbursement, or even parental leave.

Time to work work work work..

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#12

Post by cxcorp »

BleepingComputer's coverage[1] has this tidbit:

> BleepingComputer has been told that the Akira ransomware operation is behind the attack on Tietoevry, coming soon after the Finnish government warned about their ongoing attacks against companies in the country.

> "The incidents were particularly related to weakly secured Cisco VPN implementations or their unpatched vulnerabilities. Recovery is usually hard," warned the Finnish NCSC.

I wonder what the entrypoint was back in 2021 when they were attacked around the same time?

[1]: https://www.bleepingcomputer.com/news/security/tietoevry-ran...

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#13

Post by jruohonen »

thejackgoode wrote: post #9
rightbyte wrote: post #5

Tietoevry is one of these firms MBAs use to dismantle the it-department and outsorce it to. I've always thought these centralized point of failures are a bad idea.

With extra sauce of numerous mergers and rebrandings. So, every 3 to 7 years, this phoenix of shit is reborn

> With extra sauce of numerous mergers and rebrandings

That's actually a good hypothesis that hasn't been examined before, I believe.

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#15

Post by cotillion »

tgsovlerkhgsel wrote: post #7
jruohonen wrote: post #2

"One of Tietoevry’s several datacenters in Sweden has become partially subject to a ransomware attack." Sounds bad.

It only affecting one datacenter is good news, IMO: It makes it likely that the attackers didn't breach Tietoevry itself, or that they had only very limited access (unless Tietoevry has incredibly good separation between business units, so that only a small subset is affected). That increases the chance that the customers have to deal with an outage, not an outage followed by ransom demands and their customer data be…

They obviously had no separation at all between customers within the DC though. Which is worrying.

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#16

Post by throwawaynorway »

cotillion wrote: post #15
tgsovlerkhgsel wrote: post #7

Earlier quoted context omitted.

It only affecting one datacenter is good news, IMO: It makes it likely that the attackers didn't breach Tietoevry itself, or that they had only very limited access (unless Tietoevry has incredibly good separation between business units, so that only a small subset is affected). That increases the chance that the customers have to deal with an outage, not an outage followed by ransom demands and their customer data be…

They obviously had no separation at all between customers within the DC though. Which is worrying.

TietoEvry do the same in Norway, where accounts are prefixed with customer name.

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#17

Post by drumlinpasta »

cotillion wrote: post #15
tgsovlerkhgsel wrote: post #7

Earlier quoted context omitted.

It only affecting one datacenter is good news, IMO: It makes it likely that the attackers didn't breach Tietoevry itself, or that they had only very limited access (unless Tietoevry has incredibly good separation between business units, so that only a small subset is affected). That increases the chance that the customers have to deal with an outage, not an outage followed by ransom demands and their customer data be…

They obviously had no separation at all between customers within the DC though. Which is worrying.

At the moment word is that attackers encrypted Tietoevrys hypervisor platform (Hyper-V, vSphere or KVM not known) which was hosting multiple customers VMs. So attackers breached Tietoevrys management network, not customer networks.

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#18

Post by ptaipale »

rasse wrote: post #14

Probably unrelated, but their software offering in healthcare is riddled with bad practices.

Certainly unrelated. And when compared to the biggest competition (Apotti/Epic) it's a shining light of sanity... though some other providers have better user experiences.

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#19

Post by CRConrad »

jruohonen wrote: post #13
thejackgoode wrote: post #9

Earlier quoted context omitted.

With extra sauce of numerous mergers and rebrandings. So, every 3 to 7 years, this phoenix of shit is reborn

> With extra sauce of numerous mergers and rebrandings That's actually a good hypothesis that hasn't been examined before, I believe.

TBF, it's been called Tieto-something for thirty years or so. The most recent merger is visible as a suffix until the next one. Except if there isn't one for a while, then they revert to just Tieto after a few years.

Source: Worked at "TT Tietotehdas" (organic part of the name, not a suffix, AIUI) in 1996 and have had to do with it every now and then after that.

Re: Ransomware attack affecting Tietoevry's services to some customers in Sweden

#20

Post by CRConrad »

zyberzero wrote: post #3
jruohonen wrote: post #2

"One of Tietoevry’s several datacenters in Sweden has become partially subject to a ransomware attack." Sounds bad.

Yeah. From what I know at least Filmstaden (Swedens biggest cinema chain, owned by AMC) can’t sell a thing right now. No tickets can be sold at all, and no snacks can be sold at the cinema either :( Rusta is another affected store chain. I guess there is a lot more affected customers unknown to the public right now

In a meeting right now, team lead just recounted how she'd had to pay in cash at Rusta (ESpoo, I assume) yesterday or the other day because card payment wasn't working. "I was lucky to happen to have cash on me, others turned around and left."
Post reply on HN