Security Market Segment LS
Wednesday, 17 June 2020 06:49

Attackers give Lion deadline for paying ransom of US$800,000 Featured

Attackers give Lion deadline for paying ransom of US$800,000 Pixabay

Australian drinks manufacturer Lion is facing a ransom demand of US$800,000 to decrypt its files from a group that used the REvil ransomware to attack the company's site.

Security sources have told iTWire that the group has given Lion time until 19 June to pay up, and threatened to double the ransom after that. The attackers have not yet made their demands public.

Lion, which also operates in New Zealand, is a subsidiary of the Japanese beverage giant Kirin. According to Wikipedia, it has about 7000 employees and its 2015 revenue was $5.6 billion.

The company first revealed that its systems had been attacked on 9 June and has been providing regular updates, the latest being on 15 June.

In that update, Lion said: "Our investigations have shown that a partial IT system outage at Lion is a result of a ransomware attack. In response, we immediately shut down key systems as a precaution.

demand lion

A screenshot of the ransom demand.

"Our IT teams and expert cyber advisers have continued working throughout the weekend to investigate this incident, working to bring systems back online safely.

"We have made good progress. However, there is still some way to go before we can resume our normal manufacturing operations and customer service."

The note also said that it was running short of product. "Across our Australian and New Zealand adult beverages businesses, we continue to have limited visibility of our products in our systems," the note added.

"We’re working to bring our breweries back online as soon as possible, hoping to get a number of our breweries back up and running very soon."

REVil, which is also known as Sodinokibi, attacks systems running Microsoft's Windows operating system.

It is one of the growing number of ransomware packages that first exfiltrates files on a victim's system and then encrypts them on-site.

A ransom note is then generated, with instructions provided as to how payment can be made, generally in cryptocurrencies.

If the victim does not pay by the deadline, then files are slowly leaked on the dark web in small amounts as a bargaining tactic.

REvil recently started another way of making money off the data it steals, in the event that the ransom is not paid. It puts up the data for auction.

Contacted for comment, ransomware threat researcher Brett Callow said: "Like multiple other groups, REvil steals data and uses the threat of its release — or, in some cases, auction — as additional leverage to extort payment."

Callow, who works for the New Zealand-headquartered security outfit Emsisoft, added: "Companies in this situation are without a good option. They've been breached, and paying the ransom does not change that. Giving in to the group's demands will simply result in a pinky promise that the stolen data will be destroyed and misused – but, as it's coming from criminals, that pinky promise carries little weight."

iTWire has contacted Lion for comment.

Subscribe to ITWIRE UPDATE Newsletter here


The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.



iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.


Sam Varghese

Web Analytics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News