Brossard-based company Consortech was the target of a cyberattack in early March. Despite the deployment of ransomware, they quickly recovered their data. However, they had to face the threat of seeing it released publicly. The subsequent disappearance of information about Consortech from the hackers’ site suggests that they got what they wanted.
Founded in 1989, Consortech specializes in getting value out of geospatial data. The company implements solutions for processing geographic data and automating the related processes. Its clients include several municipalities.
Avaddon, the ransomware group responsible for this attack, uses the “double extortion” method to increase pressure on its victims. In addition to encrypting the data to make it inaccessible, the hackers threaten to publish it if a ransom is not paid. A sample was posted on the Avaddon group’s site. It included contacts’ names, email addresses and phone numbers.
Contacted on March 8, Mr. Guillaume Genest, partner and general manager at Consortech, confirms that ransomware paralyzed their systems. The shutdown was short-lived, because the company had “healthy backups.” They were able to get back to work quickly. Mr. Genest confirms that the criminals demanded a ransom, without specifying the amount, and that he did not pay it. According to him, it is not out of the question that the insurer will decide to pay after completing a risk analysis.
Mr. Genest cannot say when the intrusion took place. The method used by the criminals to access their systems is not yet known. “We sent a notice to all of our clients to inform them of the situation and the data leak.” The situation is in the hands of a cybersecurity firm, and no comment can be made on the extent of the leak until the results of the ongoing investigation are in.
The day after our conversation, the company’s name and the page that hosted the data samples were no longer on the “Avaddon info” site. This disappearance suggests that the company, or its insurer, decided to pay the ransom. We tried to contact Mr. Genest by email to confirm the payment, but had not yet received a reply at the time this article was published.
