Boeing Hackers Demand “Extremely Large” Ransom

The criminal Boeing hackers who used LockBit’s ransomware platform to infiltrate the company in October 2023 demanded a $200 million extortion payment, the company told CyberScoop.

Word of the  “extremely large” ransom attempt was referenced in an indictment unsealed May 6 by the U.S. Department of Justice, but it didn’t name the “multinational aeronautical and defense corporation” that received the demand. CyberScoop received confirmation that it was Boeing.

The DOJ indictment is part of a multinational offensive against a Russian national, Dmitry Yuryevich Khoroshev, identified as the main administrator and developer behind the LockBit ransomware operation. Sanctions against Khoroshev were issued by the U.K., Australia, and the U.S.

The unnamed company in the indictment was used as an example of the “extremely large” ransom demands made by Khoroshev and his affiliates. Since late 2019 they’ve received more than $500 million in ransom payments. 

Cyberscoop quotes a ransomware analyst who called the demand the second biggest to date, at least among those made public. He called it unlikely that LockBit had any way of knowing how sensitive the data stolen from Boeing was, or how much the company was willing to part with to prevent its publication. Therefore, a “ridiculously high demand” was made to see what would happen. 

Reportedly, what happened was that Boeing refused to pay anything. When about 43 gigabytes of company data was posted to LockBit’s website, the company said the incident was impacting elements of its parts and distribution business but did not affect flight safety.