Hackers Demand $1 Million in Bitcoin Ransom After Hacking Computer Systems of Insurance Firm

A hacker group known as ‘the Black Shadow’ demands Shirbit insurance company to pay a ransom of 50 Bitcoins worth $961,110 to their BTC wallet within 24 hours. The hacker group attacked the leading insurance company Shirbit Insurance in Israel on December 1.

The group has said that if the insurance firm sends the funds within the stipulated time, then they would not publicly disclose any data of the company and would not sell it to anyone. As per the media outlets, the malicious actors have already published huge collections of files that contain the private information of the company’s employees and customers.

The hackers have warned that if the insurance firm fails to send the money within 24 hours, then the ransom demand would increase to 100 Bitcoins worth $1,922,220.  Moreover, the hacker group mentioned that if another 24 hours pass, then the demand would increase to 200 Bitcoins worth $3,847,680.  The hackers warned: “After that we will sell the data to the others."  They further said that they would leak some more data at the end of every 24 hours. Shortly after the hackers published the message for the ransom demand, they further published more files, including ID cards and faxes.

On Dec. 1, the Israeli National Cyber Directorate and the Capital Markets, Insurance and Savings Authority jointly stated that they were collaborating with Shirbit to conduct investigations of the suspected attack and said that an initial probe identified that the hackers have leaked insurance details of the company.

Shirbit is known to have several government employees among its clientele, including Gilad Noitel, the President of the Tel Aviv District Court. In a Telegram message, the hackers said that they had other targets that they would reveal later and further stated that they carried out the ransomware attack in order to make money, without disclosing more details.

Zvi Leibushor, the CEO of Shirbit Insurance made comments in response to the incident. He said: “Shirbit is investing all resources and efforts needed for an effective, safe and rapid solution to the cyberattack, whose real goal is to try to harm the Israeli economy.”

According to MonsterCloud cybersecurity services company, the attack facing Shirbit comes at a time when cases of ransomware attacks against insurance firms have increased with many insurance companies in the United States suffered such attacks in the previous week.  

The hackers in the US are reported to have requested between $100,000 to millions of dollars in ransom. Zohar Pinhasi, MonsterCloud CEO, said: “This is a new trend in the US. This type of attack is caused due to a lack of cybersecurity knowledge. It seems insurance companies have a long and turbulent road ahead." However, Pinhasi said that it is unclear whether the same hackers are behind the cyber-attacks in the United States, saying that hacker groups normally change their names frequently so that to protect themselves.

While a growing number of institutions and businesses have become victims of ransomware attacks, hackers normally love cryptocurrency and demand payments to be made in crypto assets before releasing ‘hostage’ computers under their control. The anonymity associated with such digital assets is the reason why hackers choose them as their preferred means of transaction.