‘TSYS’ Downplays Ransomware Incident but Data Is Already Leaking

• The “Conti” ransomware group has attacked TSYS, but the firm says the event is immaterial to them.
• The hackers hit a legacy business that is no longer crucial to the core operations of the payment processor.
• The actors still maintain that they hold many GBs of sensitive data, including prepaid cards.

‘TSYS’ (Total System Services) suffered a ransomware attack a couple of days ago, but the company maintains that it’s really nothing to worry about. As they stated, the suspicious activity was immediately identified and contained, and it only momentarily affected certain corporate back-office functions of a legacy merchant business. Thus, all operations continue to function normally, and there have been no serious occurrences - such as stealing data from the company’s systems, for example.

However, “Conti,” who appears to be the culprit gang, has already leaked 10GB of data that they claim to derive from the attack on TSYS’s corporate network, and this is allegedly only 15% of the information they hold. Conti is only focusing on attacks accompanied by data-stealing action, and they generally don’t publish anything so soon unless the victim refuses to even negotiate with them. So, the chances of this being a bluff from the crooks’ side are minimal, although the leaked data hasn’t been confirmed as valid yet.

TSYS is the world’s third-largest payment processing service provider, belonging to ‘Global Payments,’ an American financial tech service provider. A breach oν TSYS’s systems is a severe incident as it could mean the exposure of very sensitive data. Conti claims to have prepaid card data, but TSYS denies that. The firm says that hit is ‘Cayan,’ whom they acquired for $1.05 billion in 2018. Soon after ‘Global Payments’ bought TSYS in September 2019, Cayan was partially deprecated, and this is why it’s characterized as a legacy now.

Conti may hold data that is less valuable than they think it is, but TSYS may also be playing a game of downplaying the situation. We really have no way to tell until Conti publishes more data if they ever do that anyway.

Krebs on Security has reached out to TSYS asking for a comment on all of the above, and here’s what the researcher got back in response:

The above statement leaves no margins for misinterpretation or assumptions to the seriousness of the security incident. Hopefully for the clients of the firm, this is really the case here.