Technology giant Konica Minolta hit by a ransomware attack

IT giant Konica Minolta was hit with a ransomware attack at the end of July, its services have been impacted for almost a week.

A ransomware attack has impacted the services at the business technology giant Konica Minolta for almost a week, the attack took place at the end of July.

Konica Minolta is a Japanese multinational technology company headquartered in Marunouchi, Chiyoda, Tokyo, with offices in 49 countries worldwide. The company manufactures business and industrial imaging products, including copiers, laser printers, multi-functional peripherals (MFPs) and digital print systems for the production printing market.

The multinational business technology giant has almost 44,000 employees and over $9 billion in revenue for 2019.

Since July 30th, 2020, customers began reporting accessibility problems with the access to the company’s product supply and support site.

The site was displaying the following message:

“The Konica Minolta MyKMBS customer portal is temporarily unavailable. We are working hard to resolve the issue and apologize for any inconvenience this may have caused you. If you need immediate assistance for service, please call our Global Customer Services at 1-800-456-5664 (US) or 1-800-263-4410 (Canada).”

The outage lasted for an entire week, some Konica Minolta printers were also displaying a ‘Service Notification Failed’ error.

BleepingComputer that first reported the news attempted to contact the company without receiving any response.

“After some customers stated that their Konica contacts indicated a breach caused the outage, BleepingComputer attempted to contact the company numerous times via email and phone calls.” reads the post published by BleepingComputer.

“BleepingComputer never received a response to our inquiries.”

According to BleepingComputer, who received a copy of the ransom note (titled ‘!!KONICA_MINOLTA_README!!.txt,’) employed in the attack, the company was hit with a new strain of ransomware dubbed RansomEXX.

The ransomware encrypted the files and appended the ‘.K0N1M1N0’ extension appended to their filenames.

The RansomEXX is human-operated ransomware, this means that attackers manually infected the systems after gained access to the target network.

In June 2020, the same ransomware was employed in an attack on the Texas Department of Transportation.

The good news is that the RansomEXX ransom, unlike other families of ransomwawe, does not appear to exfiltrate data before encrypting target systems.

Pierluigi Paganini

(SecurityAffairs – hacking, Konica Minolta)