Continental does not want to pay ransom to ransomware group

Cyberattacks on federal authorities, state authorities, and also companies have increased sharply in recent months and years. The well-known tire manufacturer Continental was also the victim of an extensive data theft last year. Numerous sensitive personal customer data were affected. Customers who have been caught out are now receiving a letter informing them of the theft. Meanwhile, Continental is demanding that politicians react to finally stem the wave of cyberattacks. From the point of view of the internationally successful company, there would be a very simple lever for this.

Attack on Continental in the summer of 2022

Ransomware attacks are unfortunately becoming increasingly popular in the field of cybercrime. Last July, for example, 56 GB of data from AMD was captured with the help of such software. In the summer of 2022, the world-renowned tire manufacturer Continental was also caught. The Hanover-based company claimed to have fallen victim to the notorious Lockbit hacking group. After the criminals penetrated Continental’s network, the ransomware allegedly wreaked its havoc there for almost a month. In the process, the attackers probably stole a total of 40 terabytes of sensitive data. In comparison, AMD’s yield seems almost ridiculous. But the criminals have apparently not only been able to collect valuable company data.

On top of that, many of Continental’s customers are probably affected. Since this includes well-known companies such as the traditional German brand Volkswagen, the attack could hardly be more explosive. According to a report from the Handelsblatt, employee data was probably also captured. It is said to affect a “five-digit number of employees.” Since the General Data Protection Regulation (DSGVO) stipulates that companies must personally inform those affected in such cases, they are currently receiving a letter to this effect. In order to answer important questions about how to proceed, however, Continental would like to go one step further than the legal framework requires. For example, nationwide meetings for those affected are to help in the same way as a hotline.

Ransomware brings in attractive ransom

But why is there actually such a striking increase in attacks using ransomware? This can be very exemplified by the example of Continental. Lockbit, for example, has not yet published a single megabyte of the stolen data. Instead, all that can be found on the Darknet is a list of the documents. In addition to this, the ransomware group had demanded a hefty ransom of $50 million from Continental. If this is not paid, Lockbit threatens to publish the data. Continental, however, is standing firm and emphasizes that it will not pay this money. And of course this is understandable. After all, the number of cyberattacks will continue to increase if every affected company responds to the ransom demand. Continental, meanwhile, is not turning to the extortionists.

Instead, the corporation wants politicians to take action and finally create a sensible legal framework for such situations. If the tire manufacturer has its way, the payment of ransom demands should be prohibited by law. The company is thus in line with the German Federal Criminal Police Office (BKA). For some time now, the BKA has been advising against accepting such demands. This is also the view of the IT security experts at the German Federal Office for Information Security (BSI). The reasons are easy to understand. Paying a ransom does not guarantee that the data will not be made public after all. On top of that, a successful ransom demand makes the company itself and other companies a sitting duck for cybercriminals.

• See this? USA: Court denies insurance coverage for ransomware

Fear of surreptitious ransomware

Continental’s claims are of course understandable and in line with the view of the BKA and BSI. However, there are also sharp critics of the ban on ransomware. They fear that in the event of cyberattacks, affected companies would henceforth secretly respond to the extortionists’ demands. Involving the authorities would mean that they would not be allowed to pay the demanded ransom in the first place. However, keeping the authorities out of the loop would not only lead to a high number of unreported cyberattacks. On top of that, it would make it much more difficult for the authorities to uncover such networks. Continental, meanwhile, is still working through the attack in detail. The company is apparently having difficulty analyzing the exact damage caused by Lockbit. At least, the corporation does not provide any fixed figures. However, there is no need to fear for the company’s existence. A spokesperson told Handelsblatt that the company is well insured.