CL0P ransomware hackers went after Illinois state agencies

State agencies haven’t said what information could have been compromised. Some companies that also were targeted told employees payroll information might have been compromised.

By Violet Miller

Illinois State Capitol building in Springfield. — The CL0P Ransomware Gang access Illinois’ network for three hours last month, officials said. It wasn’t clear what information they targeted.

Ransomware hackers accessed systems used by Illinois government agencies for a few hours May 31, according to the Illinois Department of Innovation and Technology, which said Friday it’s not clear what information was accessed or affected but that they expect it to end up affecting a “large number” of people.

Federal authorities have attributed the attack to the CL0P Ransomware Gang, which also went after major companies around the world last month. CL0P hackers gained access to MOVEit software, getting in to Illinois’ network for about three hours, officials said.

Sanjay Gupta, Illinois’ chief information officer, said state security teams have verified “that the vulnerability could no longer be exploited in our system.”

Officials haven’t released information on what information could have been vulnerable — or whether a ransom was demanded for the compromised information, as the gang has done in the past.

U.S. infiltrates big ransomware gang: ‘We hacked the hackers’

The BBC, British Airways and Boots — Walgreens’ UK-based retail and health stores — previously told a combined 100,000 employees that payroll data might have been taken in the same attack on MOVEit systems used by their payroll provider.

Considered “one of the largest phishing and malspam distributors worldwide” by the federal Cybersecurity and Infrastructure Security Agency, CL0P has been blamed for compromising more than 8,000 organizations globally since 2019.

The latest attack on MOVEit systems was launched in May, according to the Cybersecurity and Infrastructure Security Agency. It was first reported to the company May 28, according a spokesperson for MOVEit.

A separate attack was conducted by the ransomware group in January, using phishing scams and threats to release information. Ransom notes were sent to “upper-level executives” of companies affected by the scams, with the emails claiming to have stolen “important information” from more than 100 victims, federal officials said.

“If you ignore us, we will sell your information on the black market and publish it on our blog,” the ransom notes threatened.

Hackers have targeted Illinois in the past. Illinois Attorney General Kwame Raoul’s office network was breached in 2021,

And Russian hackers went after the state Board of Elections website in 2016.