Ilovex: custom-made ransomware encrypted PCs and the file server, and the firm checked whether customers' program assets had leaked

1. 2020-11-21

   From this day to the 23rd, an outside party got into the internal network and infected it with ransomware. [1] [3]

2. 2020-11-24

   In the morning, internal systems became unreachable and data on PCs and the file server turned out to be encrypted. The firm also found a ransom demand, cut the network and reported to IPA. [1] [3]

3. 2020-11-25

   It contacted the police and began preserving the evidence. [3]

4. 2020-11-26

   An outside security firm started helping with the investigation. [3]

5. 2020-11-30

   The firm announced that program assets it held for customers, such as source code and documents, might have leaked. [1] [2]

6. 2020-12-25

   It reported that checks since mid-December with a dedicated tool had found no sign that customer assets were published or sold. [3]

The firm described it as a targeted attack with ransomware made to order for it, which its existing defenses could not stop. The attackers not only encrypted server data but also erased access logs, which made it hard to establish the extent of the damage. [1] [2] [3]

From mid-December the firm began checking whether customers' program assets, sales and purchasing documents (supplier and sales information) and employees' personal data had been published or sold online. As of December 25, no leak of any of them had been confirmed. [3]

To prevent a repeat, it is tightening network entry points, endpoint protection, PC clean-up, logging and its response team. [3]