Singapore unicorn Pine Labs allegedly hit by ransomware; bank clients may be impacted

TEMASEK-BACKED payments platform Pine Labs might have become the latest victim of the recent global ransomware crisis, after information published on a hacker's website suggested the company's data has been stolen and held hostage.

A threat actor called BlackMatter claimed it has obtained service and private agreements between Pine Labs and multiple Indian banks from Pine Labs' network. It also said it has downloaded multiple financial reports and over 500,000 pieces of contact information.

BlackMatter said it intends to publish the data if Pine Labs does not pay the ransom.

Singapore-based Pine Labs, valued at around US$3 billion, operates mainly in India. Clients purported to be implicated in the ransomware attack include India's HDFC Bank and ICICI Bank, according to screenshots on BlackMatter's portal seen by The Business Times (BT).

Pine Labs' chief technology officer Sanjeev Kumar said the company's production systems continue to operate as usual, and consumer and transaction data have not been compromised. He said the data mentioned by the attackers involve internal information and contracts entered into in 2014, as well as contract extensions in later years. "We are, however, investigating this to see if any user laptop or server was the source of this information," he said. The 500,000 pieces of contact information refers to contact information for sales leads, said the company. (see Amendment note)

Cybersecurity company Cyble wrote in an August 11 blog post that Pine Labs was added to BlackMatter's victim list on August 10. The Cyber Security Agency of Singapore (CSA) told BT it has not received any report of a ransomware attack from the company.

BlackMatter is a new ransomware player that has been active since at least July 28 this year, according to data from Singapore-based cyber forensics company Group-IB. Its first victim was an architecture company in the US.

The group's targeting of Pine Labs may have a connection to other high-profile cases internationally.

US-based IT company Kaseya, also a tech unicorn, estimated that 800 to 1,500 businesses around the world were affected after the company was hit by ransomware. A cybercrime gang called REvil demanded US$70 million to decrypt affected devices.

Before that, an attack on Colonial Pipeline, which operates the largest fuel pipeline in the US East Coast, was orchestrated by a group that calls itself DarkSide.

Group-IB's examination of a BlackMatter sample revealed striking similarities with DarkSide and REvil, which both went off-radar after the Colonial Pipeline and Kaseya attacks. Despite the obvious connections, it is not known for sure that all three ransomware strains were created by the same developer team, Group-IB told BT.

Ransomware attacks have the potential to cripple companies, especially small and medium-sized businesses. IBM Security and the Ponemon Institute's 2020 study found that the average total cost of a data breach was US$3.86 million. Reputational impact could also cost a business its clients.

It was enough for CSA to raise the alarm in July. The agency recorded 89 cases in Singapore last year, up from 35 in 2019. A total of 68 cases were reported in the first half of 2021, already more than double the 31 cases reported in the first half of 2020.

It is unclear whether the alleged attack on Pine Labs will put a dent in the company's plans for an initial public offering (IPO), which it hopes to achieve in the next 18 months.

The IPO is expected to deliver strong returns for its host of prominent investors. Pine Labs in July announced US$600 million in funding from investors including BlackRock and Fidelity Management & Research. Its other backers include Sequoia, Mastercard and PayPal.

Pine Labs specialises in payments solutions for merchants, including point-of-sales platforms and "buy now, pay later" services.

The company has expanded in Singapore and Malaysia, and its chief executive in July mentioned plans to enter Indonesia and Thailand. In April, Pine Labs said it acquired South-east Asia-focused payments app Fave for US$45 million in a cash-and-stock deal.

READ MORE:

• Firms caught in ransomware should resist paying up: CSA
• Temasek-backed Pine Labs raises US$600m from investors including Fidelity, BlackRock
• Cybersecurity lessons from the pandemic
• Ransomware cases in Singapore rose 154% in 2020

Amendment note: Due to a source error, an earlier version of this article said 2,104 contract documents were stolen by attackers, according to Pine Labs. This is incorrect; the article has been updated to reflect that the contracts were entered into in 2014.