The anonymous collective NB65 (Network Battalion 65′) has announced that it has hacked the Russian payment service Qiwi (qiwi.ru).
Hi Qiwi (they have a twitter account lol lets see how long it takes). We rolled up and smoked ~10.5TB of backups.
Your company has been dealt with by Network Battalion 65. We recommend you contact us if you want to survive this… You guys are super fucked.#SlavaUkraini #FCKPTN pic.twitter.com/OWI6r8hn1P— NB65 (@xxNB65) May 1, 2022
Summary
Qiwi hacked, investigation underway
In the tweet announcing the hack, the hackers claim to have burned about ten and a half Terabytes of backup data, and ask to be contacted if they want to survive.
The hackers’ statement says that Qiwi is the most widely used payment application in Russia, which is why it was chosen as the target.
They reveal that they encrypted their Active Directory with a ransomware kit, and shut down their servers, domain controllers, and Hyper-V clusters, as well as encrypting all SQL databases.
They also downloaded credit card information of 12.5 million customers.
They are demanding a ransom, threatening to publish 1 million of these records per day after the three-day contact time limit has expired. They add that the company would do well to contact them soon if they want them to survive.
They state:
“We have no sympathy for you”.
They also quote Qiwi’s last press release in which they clearly stated that until now the sanctions against the Russian financial system had not affected their activities at all.
They urge people to turn to President Putin and see him as the real culprit in this situation.
Finally they add:
“Get the f**k out of Ukraine”.
Current situation
At the moment, the qiwi.ru website is still online, and there seems to be no official communication from the company about this.
However, the Russian website psm7.com reveals that the company’s customer service has stopped responding to messages, while Qiwi officials have stated on Twitter that the company’s operational capabilities are temporarily limited due to a server overload.
In contrast, Russia’s official news agency, Tass, claims that Qiwi’s payment services are working properly and that customers’ personal information is safe.
