Land Bank hackers demanded R5.4m in bitcoin, Godongwana tells MPs

Finance minister Enoch Godongwana says the Land Bank was the target of a cyberattack in an attempt by criminals to extort more than R5m in cryptocurrency from the entity — but the matter was resolved without a ransom being paid. Responding in writing to a question from MK Party MPAdil Nchabeleng, the minister said the Land Bank in January detected unauthorised activity within parts of its computer systems. “The threat actors have requested five bitcoin (of approximately R5.4m currently) as a ransom payment for the return of data and/or the non-publication of data.

The Land Bank has taken the decision not to make any ransom payment and confirms that no ransom payment was made,” he said. “Preliminary investigations indicated that a third party gained access through a vulnerability on an internet-facing server and deployed ransomware, which encrypted a portion of the Land Bank server environment as well as multiple laptops. “The ransomware targeted servers in virtual server environments that are running Microsoft operating systems.

The threat actors have been identified as a ransomware-as-a-service group” All Land Bank’s bank accounts and transactions were suspended unless transactions were specifically authorised under executive approval. It must be reiterated that ERP, core banking and CRM systems were not compromised during this incident Godongwana said the Land Bank’s critical enterprise resource planning (ERP) systems, core banking and customer relationship management (CRM) systems were not accessed and therefore not compromised. “This was due to the SAP system being in a separate technical environment from that of the rest of the servers.” He said the Land Bank has made all statutory and regulatory notifications, including: “Land Bank is engaging with the Prudential Authority and has been providing updates on restoration and management of the incident.” Its formal notification to the Prudential Authority was supplied on January 29.

[paywall]

He said the Land Bank also notified the State Security Agency last month and made voluntary notifications to various government departments, agencies and critical stakeholders. Godongwana said the Land Bank isolated its environment, removed indicators of compromise, strengthened its security controls by hardening and configuring firewalls and patching vulnerabilities, amongst other measures, to ensure that any unauthorised attempts to enter its IT environment can be detected and remediated. “All Land Bank’s bank accounts and transactions were suspended unless transactions were specifically authorised under executive approval. It must be reiterated that ERP, core banking and CRM systems were not compromised during this incident.”

[/paywall]