Hacking network linked to Russia was to blame for Royal Mail cyber attack, report claims 

A hacker group linked to Russia was behind a cyber attack on Royal Mail that forced the postal group to halt international deliveries, it was reported last night.

The incident, which has effectively paralysed Royal Mail’s huge Worldwide Distribution Centre near Heathrow airport, was orchestrated by a hacker gang called Lockbit, it has been claimed.

The gang specialises in using ransomware, a type of cyber attack that threatens to block access to or publish sensitive data unless the victim pays a ransom. Its signature software, known as Lockbit Black, scrambled computer systems on Royal Mail machines that are used to print customs documents needed to send parcels overseas.

Printers reportedly began spurting out ransom demands at a Royal Mail sorting base at Mallusk in Country Antrim, Northern Ireland. The demands, claiming to be from Lockbit, warned: ‘Your data are stolen and encrypted’.

Staff were invited to get in contact with the gang to decrypt one file ‘for free’ – probably to prove their claims to be behind the hack. It is not known if Royal Mail has communicated with the hackers.

Lockbit’s members are thought to have close links to Russia and to have extorted an estimated £82million from previous victims, which have included children’s hospitals as well as UK car dealership chain Pendragon, The Daily Telegraph reported.

‘We benefit from the hostile attitude of the West [towards Russia],’ a Lockbit member said in an online chat. ‘It allows us to conduct such an aggressive business and operate freely within the borders of the former Soviet countries.’

Lockbit first emerged in September 2019 and has since become one of the most prolific ransomware gangs, cyber security experts said.

A hacker group linked to Russia was behind a cyber attack on Royal Mail. Pictured: Royal Mail’s Heathrow distribution centre, December 18, 2018

Royal Mail warned on Wednesday night that it was experiencing ‘severe disruption’ and was unable to send letters and parcels overseas due to a ‘cyber incident’. More than half a million parcels and letters are now stuck in limbo. The company has yet to say when things will be up and running again, but it is thought the recovery effort could take up to a week.

Royal Mail is investigating and is working alongside external experts to fix the problem as well as the Government’s National Cyber Security Centre and the National Crime Agency. The firm declined to comment.