Hackers are holding foreign exchange giant Travelex to ransom, after a cyber-attack forced the company to switch off all its computer systems.
Hackers infiltrated the company’s systems on New Year’s Eve, the company and have taken down 30 of its websites to contain “the virus and protect data”. Hackers are now demanding a ransom to withdraw from Travelex’s computer systems, with a deadline having been set by those responsible.
The Metropolitan Police said they were investigating the matter in a statement today.
It read: “On Thursday, 2 January, the Met’s Cyber Crime Team were contacted with regards to a reported ransomware attack involving a foreign currency exchange. Enquiries into the circumstances are ongoing.”
The attack has meant that Travelex staff have resorted to using pen and paper, while a recovery operation is being conducted at an undisclosed UK location. The foreign exchange company had not previously disclosed the information, despite the cyber attack happening a week ago.
Websites across Europe, Asia and the US have been offline ever since.
The cyber attack has meant that other firms who use Travelex’s services are not able to provide currency exchange services. This includes Sainsbury’s Bank and Virgin Money.
Security researcher Kevin Beaumont said that the response from Travelex had been “shockingly bad”.
“The Travelex UK website still only says ‘planned maintenance’, a week after the problems began, – many customers will be completely unaware hackers gained access to their network, and allegedly their personal data,” he said. Travelex was founded in London in 1976 and now has cash exchange points across the world.
In September this year Travelex employee who stole more than £70,000 from one of the firm’s currency exchange bureaus was sentenced for fraud.
Dubravko Kuftinec, 52, fraudulently stole £72,186 from Travelex’s Fleet Street branch inside the Goldman Sachs building.
Kuftinec was sentenced to 21 months in jail suspended for two years at Inner London Crown Court. He was also ordered to carry out 100 hours of unpaid work and a confiscation timetable set. He had previously pleaded guilty to one count of fraud between 29 April, 2018 and 12 June, 2018 at an earlier court hearing.