A ransomware group has targeted petroleum products distributor Filgo-Sonic. The company shut down some of its IT systems, but deliveries to customers continued.
Ms. Véronique Simard, a spokesperson for the organization, replied that the company “confirms that in recent weeks it experienced a shutdown of its IT systems that affected certain operations. While the Group works to restore normal operations, customer service continues without interruption.”
The company did not give details on which services were affected, but specified that “these are mainly central services such as billing.” Shutting down these systems “was necessary as a protective and remediation measure following a cyberattack carried out by an attacker outside the organization,” Ms. Simard explained. With the investigation still ongoing, the company cannot provide further details, but says the systems are being restored.
The criminals published documents they claim to have stolen from the company. These documents are dated June 3 and June 27. The spokesperson says the company “is aware that the attackers published files. Our IT team and our cybersecurity experts retrieved these files and analyzed them.” They are currently in the process of notifying the people affected by this security incident.
Groupe Filgo-Sonic is a Québec company headquartered in Sainte-Marie, in the Beauce region. It owns the Miraco and Sonic gas station banners. According to its website, the Group is “present in Québec’s main regions.” It operates in the distribution of petroleum products to residential and commercial customers, maintains a network of gas stations and convenience stores, and distributes Shell Lubricants.
“Vice Society,” the group that claimed this attack, appeared on the ransomware scene in June 2021. Despite being new, it was one of the most active groups in June. This criminal group announced about ten security breaches during its first month of operation. Schools and hospitals are among the organizations listed on its site.
The software used to encrypt the files is reportedly a variant of the “HelloKitty” ransomware, according to Michael Gillespie, a researcher specializing in malware. The “HelloKitty” group recently made headlines because it had been blamed for the attack against video game company “CD Projekt,” creator of the title “Cyberpunk 2077.”
