Royal Mail ‘facing $80m ransom bid’

The United Kingdom’s postal service, Royal Mail International, has rejected a huge ransom demand from a gang of hackers, according to a leaked cache of online chats.

The Lockbit hacker group claims it has stolen sensitive data from Royal Mail and will leak it if its demands are not met, according to information on the dark web, as reported by British media outlets.

The online chats, first reported by ITpro.co.uk, reveal negotiators for the postal service have rebuffed a demand for 65.7 million pounds ($80 million), describing it as “absurd”.

Royal Mail has not yet confirmed it is facing a ransomware attack, though media reports say screenshots of Lockbit’s dark web site claim the group is responsible.

The ITpro website reported that Lockbit leaked the entire negotiation chat history between it and Royal Mail, which according to message timestamps, began on Jan 12 and ended on Feb 9.

Lockbit is reported to have calculated that the 65.7 million pounds ransom amount equates to 0.5 percent of Royal Mail International’s annual revenue.

The chat shows Royal Mail claiming its annual revenue was “800 million” and citing news reports that revealed its poor financial performance recently.

The ransomware cartel, which is alleged to have Russian links, confirmed last week that it was responsible for the Jan 10 cyber attack on Royal Mail, which has severely disrupted the postal service, leaving it unable to accept mail for international dispatch.

The Daily Telegraph newspaper reported that the cyber attack blocked international deliveries by locking up crucial printers used for creating customs labels.

The leaked chats show that negotiations with the hackers have now deteriorated after more than three weeks of exchanges, reported the Financial Times.

“Under no circumstances will we pay you the absurd amount of money you have demanded,” the negotiator said, according to the leaked chats. “This is an amount that could never be taken seriously by our board.”

The hackers appeared to ask for an estimate of the company’s revenues, to which the negotiator responded: “All we have had is losses … there are several articles on Google about our financial situation and how bad it is currently.”

When asked if the leaked chats were authentic, Royal Mail declined to comment.

“As there is an ongoing investigation, law enforcement has advised that it would be inappropriate to make any further comment on this incident,” a spokesperson for Royal Mail said.

Shmuel Gihon, a security researcher at CyberInt who has studied the Lockbit group closely, told the Financial Times the gang seems to be very well briefed, as it has cited knowledge of revenue and even of “relevant regulations in the victim’s country”.

The predicament piles more pressure on Royal Mail, after workers went on strike in December over jobs, pay, pensions, and conditions. Another walkout is set for Thursday.