FatFace Pays $2million Ransom To Cyber Criminals

British clothing retailer FatFace paid out a $2m ransom to restore its data following a January 2021 cyber attack by the criminal hacking group called Conti.  

The criminals initially demanded a ransom of 213 Bitcoins, about $8 million/£5.8 million, but agreed to lower the amount to $2 million after FatFace's negotiator explained that the firm's revenues had slumped over the past year due to lockdown restrictions. 

Conti finally agreed to a $2 million payment, saying that it didn't want to bankrupt the retailer.

Conti told FatFace that it had initially breached their network via a phishing attack on 10th January 2021. The gang used this compromise to gain admin rights and expand its reach through the network, as well as identifying the firm's Veeam backup servers and Nimble storage. The final attack occurred on 17th January, when the criminals were able to exfiltrate over 200GB of data from FatFace's systems before encrypting machines.

After receiving the ransom pay-out, Conti offered advice to the company's IT team about how they could strengthen security to prevent cyber attacks in future.

Advice included implementing email filtering, reviewing Active Directory password policy, conducting employee phishing tests, and investing in better endpoint detection and response technology. FatFace disclosed the security breach to customers in an email last week, informing them that some customer details - including names, email and postal and addresses, and limited credit card data - had been compromised in an attack on its systems.

The company asked customers to keep information about the data breach 'strictly private and confidential'. It also told customers that the delay in informing them occurred as they were working to identify the hackers behind the incident and to determine precisely what information was stolen.

Under the terms of the GDPR, companies must tell the ICO of a breach within 72 hours of becoming aware of it. If they decide there is a high risk to individuals' rights and freedoms, they also need to inform affected individuals 'without undue delay'.

FatFace confirmed the ransomware attack and they notified the ICO and law enforcement agencies about the incident. Almost 5,000 ransomware attacks hit British firms in 2019, with criminals collecting payments of nearly £210 million, the US cyber security firm Emsisoft said in a report last year. The company said that organisations are showing 'more willingness' to pay ransoms due to fears of public embarrassment, lost data and potential penalties from regulators (of course, paying a ransom to retrieve stolen data does not avoid fines for losing that data in the first place).

The 2020 CrowdStrike Global Security Attitude Survey revealed that almost 40% of UK organisations had been subject to ransomware attacks in the past 12 months, and 13 per cent of them had chosen to pay the ransom.

Some of the other key findings in the report is a growing fear of nation-state intrusions and ransomware attacks in the wake of COVID-19 outbreaks: 

  • 56% of organisations surveys reported a ransomware attack within the last 12 months.
  • 87% of respondents indicated that nation-state attacks are much more common than commonly supposed.
  • 73% say nation-state attacks are the single biggest threat to their organisations. 
  • 84% say they have accelerated their digital transformation efforts as a result of COVID-19, Potentially compounding their risk.
  • 45% stating that they have increased cloud rollouts to support employees working remotely. 

According to Crowdstrike, UK businesses paid an average ransom of £940,000 ($1.2 million) which is higher than the global average of $1.1 million.

Crowdstrike:     Information Commissoner:        Computer Weekly:         Computing

You Might Also Read: 

Ransomware Victim Travelex Folds:

 

« Twenty Cyber Security Startups To Watch
Half A Billion LinkedIn Members Found For Sale »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

MailGuard

MailGuard

MailGuard delivers a full suite of security solutions across email and web to protect your business before threats reach your environment.

BeOne Development

BeOne Development

BeOne Development provide innovative training and learning solutions for information security and compliance.

Paygilant

Paygilant

Paygilant’s disruptive technology is designed to protect mobile payment  financial transactions against fraudulent attacks, whether executed by NFC, QR code, P2P or in-app.

Elliptic

Elliptic

Elliptic solve the crucial problem of identity in cryptocurrencies, with the sole purpose of combating suspicious and criminal activity.

Exeon Analytics

Exeon Analytics

Exeon Analytics is a Swiss cyber security company that is specialized in detecting hidden data breaches and advanced cyber attacks.

IT Search

IT Search

IT Search is a specialist IT recruitment company focusing on Cyber Security, IT Infrastructure, Software, Data, Digital Transformation and C Suite leadership positions.

IP Twins

IP Twins

IP Twins offer a wide range of services related to domain names and online brand protection.

Cryptyk

Cryptyk

CRYPTYK CLOUD is the first complete enterprise-class cloud security solution that includes cloud storage and broad protection against all external and internal threats.

NetSPI

NetSPI

NetSPI is an information security penetration testing and vulnerability assessment management advisory firm.

Nu Quantum

Nu Quantum

Nu Quantum is developing quantum photonics hardware to power the quantum revolution in communications, sensing and computing.

Huntington Ingalls Industries (HII)

Huntington Ingalls Industries (HII)

Huntington Ingalls Industries is America’s largest military shipbuilding company and a provider of professional services to partners in government and industry.

National Coordinator for Security and Counterterrorism (NCTV) - Netherlands

National Coordinator for Security and Counterterrorism (NCTV) - Netherlands

The NCTV serves the Netherlands’ national security. We protect national interests, identify threats and strengthen resilience.

Blackpanda

Blackpanda

Blackpanda is Asia’s premier cyber security incident response group, hyper-focused on digital forensics and cyber crisis response.

U2opia Technology

U2opia Technology

U2opia is a consortium with a proven track record of delivering groundbreaking technology, cybersecurity, and innovative business solutions.

Mogwai Labs

Mogwai Labs

Mogwai Labs deliver cutting-edge penetration tests, security assessments and trainings, to safeguard your applications, networks and cloud environments from cyber threats.

Skillfield

Skillfield

Skillfield is a Melbourne based Cyber Security and Data Services consultancy and professional services company.