Macmillan shuts down systems after likely ransomware attack

Macmillan

Publishing giant Macmillan was forced to shut down their network and offices while recovering from a security incident that appears to be a ransomware attack.

The attack reportedly occurred over the weekend, on Saturday, June 25th, with the company shutting down all of their IT systems to prevent the spread of the attack.

Publishers Weekly first reported on the incident, seeing emails from Macmillan that stated they suffered a "security incident, which involves the encryption of certain files on our network." The use of encryption in the attack indicates that it was a ransomware attack.

Since then, Macmillan editors have been unusually transparent about the security incident, telling agents and clients that they are not being ignored, but have lost access to their systems, emails, and files.

While Publishers Weekly said that Macmillan field sales team was warning that the disruption could cause delay in book shipments, Macmillan has already begun bringing systems back online, with employees now able to access their email.

At this time, it is unclear what ransomware gang is behind the attack and if data was stolen.

However, ransomware affiliates commonly steal data before encrypting devices for use in double-extortion attacks, where they threaten victims they’ll publish the stolen data if a ransom is not paid.

If data was exfiltrated during the attack and a ransom is not paid, we will likely see a ransomware operation publishing the stolen files on their data leak site within a few weeks.

Macmillan sent the following statement to BleepingComputer:

"Macmillan recently experienced a security incident, which involves the encryption of certain files on our network. As a precautionary measure, we immediately took systems offline to prevent further impact to our network. We are working diligently with specialists to investigate the source of this issue, understand its impact on our systems, and to restore full functionality to our networks as soon as possible.

Customers and other third-party partners may notice that certain systems are unavailable while these efforts are underway. Please know that the Macmillan team is working around the clock on this restoration and installation of additional network safeguards.

We are bringing certain systems back online, including those that we took offline as a precautionary measure. We have made good progress getting our teams access to key systems. Our UK warehouse resumed operations on June 28. For the US, we are accepting orders electronically, but are unable to process them at this time. We will continue to communicate updates as they come." - Macmillan.

7/1/22: Added statement from Macmillan

Results for “"macmillan"”

Macmillan shuts down systems after likely ransomware attack