Tietoevry: Ransomware attack in Sweden – restoration work progressing

On 20 January, one of Tietoevry’s several datacenters in Sweden was partially subject to ransomware attack. The attack has impacted Tietoevry’s services to a limited number of customers in Sweden. The affected platform was isolated immediately, and the attack has not impacted other parts of Tietoevry’s infrastructure. The work to restore the impacted services is progressing.

The malicious attack based on Akira ransomware on one of Tietoevry’s datacenters in Sweden took place during the night of 19-20 January. Tietoevry takes the situation very seriously and has an extensive team of experts and technicians working around the clock to minimize the impact and restore services. Tietoevry has completed essential stages for initiating restoration of the customer-specific services.

Considering the nature of the incident and the number of customer-specific systems to be restored, the restoration process may extend over several days, even weeks. The company is focused on resolving this as soon as technically possible, in close collaboration with the customers in question.

Tietoevry has increased the preparedness and surveillance of its infrastructure overall as a security measure. As ransomware attack is a serious criminal act, Tietoevry is collaborating with relevant authorities and has filed a report to the Swedish police.

Due to the exceptional nature of ransomware attacks and the early stage of the restoration process, the company is not able to fully assess financial impact while currently anticipates it not to be material at the Group level.

Please find earlier published statements here:

21 January: UPDATE: Ransomware attack in Swedish data center (tietoevry.com)

20 January: Ransomware attack affecting services to customers in Sweden (tietoevry.com)