Wholesale Giant METRO Hit By A Cyberattack, Suffers IT Outage

Severity

High

Analysis Summary

The global wholesale giant METRO is suffering infrastructure problems and issues with store payments following a recent cyberattack.

Metro employs around 95,000 people in 681 stores globally, the majority of which are in Germany, and its revenues are expected to exceed 24.8 billion euros in 2020. It runs 661 wholesale outlets under the METRO and MAKRO brands.

With the assistance of external specialists, the company’s IT department is currently investigating the incident to determine what caused this prolonged outage.

Metro experiences a partial infrastructure outage for several technical services.

“METRO/MAKRO is currently experiencing a partial IT infrastructure outage for several technical services. METRO’s IT team, together with external experts, immediately launched a thorough investigation to determine the cause of the service disruption. 

Despite the fact that its stores are still open, METRO says that it was compelled to set up offline payment methods and that online purchases are being delayed.

“Online orders through the web app and online store are being processed but delays need to be expected, as well.”

The company has informed the relevant authorities of this security incident, and it is ready to assist with any further attacks-related investigations.

‘We will continue intensive analysis and monitoring and provide updates as required. METRO sincerely apologizes for any inconvenience the incident is causing for any of its customers and business partners.’: they conclude the statement.

Although the company withheld technical information regarding the attack, Metro’s issues imply it was a ransomware attack victim.

Impact

• Infrastructure Outages
• Service Interruption

Remediation

• Maintain cyber hygiene by updating your anti-virus software and implement patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Passwords – Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
• Admin Access – limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• WAF – Web defacement must be stopped at the web application level. Therefore, set up a Web Application Firewall with rules to block suspicious and malicious requests.
• Patch – Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Secure Coding – Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• 2FA – Enable two-factor authentication.
• Antivirus – Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using a multi-layered protection is necessary to secure vulnerable assets