The ransomware group targeting London Drugs has removed its ransom demand from the internet, hours before the time the retailer was ordered to pay millions of dollars, according to a threat analyst.
LockBit, the perpetrators claiming to be behind the ransom, were demanding that London Drugs pay $25 Million in exchange for data stolen during the April cyberattack.
The ransomware group was threatening to leak employee information on the dark web if those demands were not met.
The initial post, which was discovered on Tuesday afternoon, included a 48-hour compliance window. However, as of late Wednesday morning, the demand has mysteriously vanished.
Emsisoft threat analyst Brett Callow believes there are a few things that might have happened.
“Possible explainations would be that London Drugs paid, or that they agreed to go back to the negiotating table. But, there are other possibilites too,” Callow told CityNews.
Callow says that it’s also not uncommon for ransomware groups to retract their demands from online listings before the deadline expires.
“That’s because it’s not uncommon for organization to succumb to the pressure and pay.”
LockBit alleges that London Drugs had initially offered $8 million for the data, but this remains unconfirmed by the retailer.
CityNews contacted London Drugs regarding the removal of the listing. In response, the company says “there is no update to share.”
More to come