Cybercriminals hacked the website of Luas demanding ransom in Bitcoin

• The website of Luas, the tram system in Dublin, Ireland, was hacked by attackers who claimed to have gained access to the customers’ private data stored in the system.
• The attackers left a ransom note in the website demanding one bitcoin for not leaking customers’ private data.

The website of Luas, the tram system in Dublin, Ireland, was hacked on January 3, 2019, by attackers who also claimed to have gained access to the customers’ private data stored in the system. The attackers hacked the website and published a malicious message on the website threatening to expose customers' private data thereby demanding one bitcoin as ransom.

Upon learning about the incident, Luas warned its customers in a Twitter post not to access its website due to an ongoing issue. “Due to an ongoing issue, please do not click onto the Luas website. We currently have technicians working on the issue. We will be using this forum only for travel updates should the need arise,” the Tweet read.

What happened?

Attackers have hacked the website of Luas, Dublin’s tram system and published a malicious note on the website demanding one bitcoin as ransom within 5 days. If the ransom demand is not met, the attacker threatened to leak all private data of customers and send emails to customers. The attacker also attached his bitcoin address in the message.

As per the report by ZDNet, the malicious message read as follows:

"You are hacked. Some time ago I wrote that you have serious security holes, you didn't reply. The next time someone talks to you, press the reply button. You must pay 1 bitcoin in 5 days otherwise I will publish all data and send emails to your users. btc address: 3FsR4CTUmumBJK12Zk8QRwdpPTJEY11aSX"

Later, Luas tweeted that its website was compromised. “The Luas website was compromised this morning, and a malicious message was put on the home page. The website has been taken down by the IT company who manage it, and their technicians are working on it. Luas are informed this may take the day to resolve,” the tweet read.

However, the bitcoin address provided by the attacker has not received any funds yet, which means Luas has not paid the ransom.