Transport and logistics giant Toll Group has confirmed some of its employee and customer data has been stolen following a cyber security attack.
It comes only months after a previous incident, with the company announcing a second breach on May 5. It responded again by shutting down some of its IT systems, including MyToll.
Toll has since been working with IT security experts who identified the attack as a “relatively new form of ransomware” known as Nefilim.
The Australian Cyber Security Centre (ACSC) and the Australian Federal Police (AFP) have also been notified and are working on the case.
“Toll has refused from the outset to engage with the attacker’s ransom demands, which is consistent with the advice of cyber security experts and government authorities,” the company says.
“Our ongoing investigations have established that the attacker has accessed at least one specific corporate server.
“This server contains information relating to some past and present Toll employees, and details of commercial agreements with some of our current and former enterprise customers. The server in question is not designed as a repository for customer operational data.
“At this stage, we have determined that the attacker has downloaded some data stored on the corporate server, and we are in the process of identifying the specific nature of that information.
“The attacker is known to publish stolen data to the ‘dark web’. This means that, to our knowledge, information is not readily accessible through conventional online platforms. Toll is not aware at this time of any information from the server in question having been published,” the company says.
Toll Group managing director Thomas Knudsen has also issued a statement and says the company is the victim of an “unscrupulous act”.
“We condemn in the strongest possible terms the actions of the perpetrators,” Knudsen says.
“This a serious and regrettable situation and we apologise unreservedly to those affected. I can assure our customers and employees that we’re doing all we can to get to the bottom of the situation and put in place the actions to rectify it”, he says.
Toll expects that it will take a number of weeks to determine more details given the technical and detailed nature of the analysis in progress.
The company is now contacting people it believes may be impacted and is implementing measures to support individual online security arrangements.
Knudsen says cyber crime posed “an existential threat for organisations of all sizes, making it more important than ever for business, regulators and government to adopt a united effort in combatting the very real risk it presents the wider community”.
