Garmin confirms it’s back online after mysterious ‘WastedLocker’ ransomware attack took fitness app down globally
GARMIN is back online after millions of fitness fanatics across the globe were unable to use their wearable gadgets over the weekend.
The lengthy outage was the work of a sinister cyber attack and normal service is expected to resume in the coming days, the US tech firm said.
Is Garmin down?
Fitness smartwatch firm Garmin shut down its connected services and call centres on July 23 following what the company called a worldwide outage.
"Garmin is currently experiencing an outage that affects Garmin services," the firm said in a statement last week.
"As a result of the outage, some features and services across these platforms are unavailable to customers."
Problems affected Garmin services including Garmin Connect, which wearers use to manage and upload data collected by their gadgets.
As a result, wearers could not record their fitness activities, such as running, cycling or swimming.
As of Monday, July 27, services are gradually being restored, according to Garmin.
Dozens of users on Twitter have reported that the app and website are both back online following the four-day blackout.
However, some services are still experiencing issues, according to reports.
"As our affected systems are restored, we expect some delays as the backlog of information is being processed," Garmin said in a statement on Monday.
Why was Garmin down?
Garmin initially offered customers no explanation for the down time, merely stating that it was experiencing a global outage.
Shortly after the issues began, security analysts revealed that the company fell victim to a coordinated cyber attack.
This theory was confirmed by Garmin in a statement issued on Monday.
“Garmin today announced it was the victim of a cyber attack that encrypted some of our systems on July 23, 2020," the firm said.
"As a result, many of our online services were interrupted including website functions, customer support, customer facing applications, and company communications."
Several Garmin employees took to social media last week to say the company had suffered a ransomware attack.
Ransomware is a type of cyber attack that sees hackers take control of computers, tablets or mobile phones remotely and demand a payment.
Those who don't pay up are locked out of their computers for good.
Often the hackers trick the user into downloading malicious software – using a dodgy email or app – and encrypt the victim’s information.
Who hacked Garmin?
Garmin has not disclosed details on who or what was responsible for the high-profile hack.
Experts have suggested that the outage appeared to coincide with a WastedLocker ransomware attack against the fitness giant.
Sources at Garmin have confirmed to both and that the company was the victim of WastedLocker malware.
WastedLocker is a type of ransomware used by a Russian group of cybercriminals called Evil Corp.
The sinister collective is headed up by 33-year-old Russian playboy hacker, Maksim Yakubets.
Mr Yakubets is wanted by the FBI and has been accused of stealing at least $100million since he began his life of cyber crime in 2009.
A $5million bounty was put on his head in December 2019 by the American authorities as he was named the world's biggest cyber-criminal.
Western law enforcement alleges Mr Yakubets has actively worked with the Russian Federal Security Service since 2017.
National Crime Agency director Rob Jones has described the lifestyle of Ukrainian-born Mr Yakubets as "flamboyant and extravagant."
He's "cash-rich with fast cars" - driving a customised Lamborghini supercar with a personalised number plate and lettering that means 'Thief' in Russian.
As Garmin has not confirmed it was the victim of a WastedLocker or other ransomware attack, any link is purely speculative for now.
According to The Verge, it's possible to avert a WastedLocker attack by recovering company data using backup files.
This allows the victim to take back control of its data without paying a ransom. For large companies, the process can take several days.
What was the Garmin ransom?
Ransom demands associated with WastedLocker are usually very pricey.
However, it is unclear if any such demands were made and suggestions of a ransomware attack remain speculative.
The attack works by encrypting the company's files and other data, rendering it inaccessible to employees.
Evil Corp demanded a $10million ransom for the safe return of the data, sources told BleepingComputer.
Screenshots shared by the tech site showed Garmin company files encrypted with a ransom note attached.
The note told recipients to contact one of two email addresses to "get a price for your data".
Is my Garmin data safe?
Fortunately, there's no reason to believe EvilCorps stole or shared the data of Garmin users.
The alleged hack appears to have been a coordinated attempt to extort money from Garmin, rather than make cash off of users' information.
However, there's no guarantee the group chose not to siphon off user data to sell to other hackers or for use in other cyber attacks.
Garmin says it collects personal data including your name, email address, location, text and call data, and other information.
In its Monday statement, the firm confirmed hackers did not access user data.
"We have no indication that any customer data, including payment information from Garmin Pay, was accessed, lost or stolen," Garmin said.
When will Garmin be back online?
It appears some Garmin services have been partly restored, though some parts of the app and website are still down.
Garmin said it expected full service to resume soon.
"Affected systems are being restored and we expect to return to normal operation over the next few days," the firm said in its statement.
Check Garmin's and its for further updates.
How to stay safe from hackers
- Protect your devices and networks by keeping them up to date: use the latest supported versions, use anti-virus and scan regularly to guard against known malware threats.
- Use multi-factor authentication to reduce the impact of password compromises.
- Tell staff how to report suspected phishing emails, and ensure they feel confident to do so, investigate their reports promptly and thoroughly.
- Set up a security monitoring capability so you are collecting the data that will be needed to analyse network intrusions
- Prevent and detect lateral movement in your organisation’s networks.
Most read in Phones & Gadgets
In other news, Samsung's Galaxy Z Flip 5G smartphone is set to be released on August 7.
A security vulnerability that could let hackers set fire to smartphone fast chargers has been revealed.
READ MORE SUN STORIES
And, Apple is planning to load future iPhone cameras with high-powered zoom capabilities, according to one insider.
Do you use a smartwatch? Let us know in the comments...
We pay for your stories! Do you have a story for The Sun Online Tech & Science team? Email us at [email protected]