Travelex, a London-based major foreign currency exchange company with operations in more than 27 countries, has suffered a malware attack in which its system including website and online services, has been affected.
The attack that took place on December 31st (New Year’s Eve) but two days have passed, the company’s site remains offline with “Runtime error” on its homepage.
Travelex acknowledged the malware attack in a series of tweets to its customers.
“Travelex confirms that a software virus was discovered on new year’s eve which has compromised some of its services, the company stated in a tweet earlier today.
In one of its tweets, the company stated that there is “no indication that any personal or customer data has been compromised.”
Our investigation to date shows no indication that any personal or customer data has been compromised. We've deployed teams of IT specialists and external cyber security experts who've been working continuously since New Year’s Eve to isolate the virus and restore the systems.
— Travelex UK (@TravelexUK) January 2, 2020
In another tweet, Travelex responded that after the malware attack the company had to take its system offline “to protect data and prevent the spread of the virus.”
Although it is unclear what type of malware was used in the attack against Travelex or whether it was a ransomware attack, the company has deployed teams of IT specialists and cyber security experts to isolate the malware and restore affected systems.
On the other hand, businesses using Travelex are also facing service disruption. For instance, Tesco Bank’s online service is also offline and urges customers to “Find your nearest store” to use the Travel Money feature.
In one of its Tweets, Tesco Bank confirmed that the outage is related to the malware attack on Travelex.
Unfortunately, our on-line Travel Money service is currently unavailable due to IT issues at our partner, Travelex. In the meantime, you can still visit one of our in-store bureaux to collect or purchase your currency. Sorry for any inconvenience.
It is worth noting that on January 1st, 2020, Lloyds, Halifax and Bank of Scotland online banking systems was also crashed. However, all three claimed that the service outage was an internal problem, not a cybersecurity one.
According to Steve Blow, UK systems engineering manager, Zerto: “While nearly all banks will have a disaster recovery strategy in place, as shown by Lloyds, Halifax, and Bank of Scotland, it’s clear that these plans are not enough to ensure banking organizations remain online, regardless. Many UK consumers will be familiar with their banks taking ‘scheduled downtime’ during the evening as one of those simple facts of life, but there increasing headlines about the disruption of a cyber-attack or updating error.”
“In a 24/7 commercial market place, this is becoming increasingly inconvenient for customers, and will likely lead to banks losing out to competitors during off-hours. To combat this, banks need to transition to a cyber-resilient approach, without which they cannot truly be considered an always-on service,” said Steve.
It’s a fact that cyber attacks against businesses especially financial institutions are increasing. In 2018, an estimated 2 million cyberattacks took place costing more than $45 billion in damages worldwide while ransomware-type attacks caused $8 billion in damages. It is believed that ransomware attacks will grow to cost $20 billion in 2021.
At the time of publishing this article, Travelex’s website was offline. However, this article will be updated accordingly, therefore, stay tuned.
Update: 10th April, 2020:
Travelex has reportedly paid $2.3 million ransom payment to the REvil ransomware group.
Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.