Travelex: First UK systems restored after cyber attackers demanded ransom
The foreign exchange specialist reports that some systems are now back up and running following the ransomware attack.
Friday 17 January 2020 15:21, UK
Travelex, the foreign exchange operator held hostage by cyber attackers since New Year's Eve, has said a phased restoration of its global systems is finally underway.
The company said automated order placement systems used by UK banking partners, which include HSBC, Barclays and Virgin Money, were now live.
However, RBS and Tesco Bank later reported that their respective travel money sites, powered by Travelex, remained offline.
Travelex said VAT refund services at airports were also coming back to life.
In-branch retail systems are currently being tested and "good progress" is being made on its UK-based international money transfer service, which Travelex says will relaunch by the end of the January.
The company is prioritising UK functionality because it's its largest market.
It made the announcement 18 days after ransomware took hold of its services,forcing branch staff to serve customers with a pen and paper after online systems were taken down.
The Sodinobiki gang reportedly demanded a £4.6m ransom and threatened to release customer data including social security numbers, dates of birth and payment card information unless Travelex paid up.
The company insisted at the time there was no evidence that customer data had been breached and it has refused to give details surrounding the attack.
It has also not said if any ransom was paid.
Travelex is working with the National Cyber Security Centre and London's Metropolitan Police as part of a criminal investigation.
Banking sector body, UK Finance, said of the attack: "When incidents such as these occur, firms work hard to get services back up and running as soon as possible.
"However, individual firms will have their own processes in place to ensure there is no risk to customers.
"This could lead to a delay between Travelex restoring its systems and partner firms being able to begin offering related services again.
"Customers should be vigilant of criminals attempting to use the news of the Travelex incident as an opportunity to trick them into revealing personal or financial information, and remember to always follow the advice of the Take Five to Stop Fraud campaign."