The "Hive" ransomware group
has claimed responsibility for
a cyber attack disclosed by
Tata Power.
Hive claimed to have encrypted the systems
of the electric utility subsidiary of Tata
Group on 3 October at around 7 pm,
disclosing the attack on 24 October in a post
on its leak site. The files includes
employment contracts, supplier contracts,
'master' files on various employees,
documents detailing senior executives'
remuneration packages, and more.
This comes after Tata Power declared on 14
October in a stock exchange filing it had
suffered a cyber attack on its IT
infrastructure.
The company said it had taken steps to
retrieve and restore the systems, without
revealing what kind of attack it was or who it
was carried out by.
“All critical operational systems are
functioning; however, as a measure of
abundant precaution, restricted access and
preventive checks have been put in place for
employee and customer-facing portals and
touch points,” the company said at the time.
Hive is one of the most successful
ransomware organisations currently in
operation and is run in a similarly
'professional' fashion as other high-profile
gangs of past and present, such as REvil and
LockBit. Once infected, victims are taken to
a bespoke portal where there are agents
working for Hive that guide victims through
the ransom payment process via live chat
functionality.
Hive is known for its aggressive and
unsympathetic approach to negotiating
ransom payments and has been observed
using tactics such as triple extortion - a
method becoming increasingly popular
among the most well-resourced groups.