The hackers are the DoppelPaymer gang.

On Tuesday, Bleeping Computer reported that Kia Motors USA was experiencing a nationwide outage that affected its servers, dealer platforms, and phone support services. The size and scope of the dislocation led Bleeping Computer to speculate that “this is likely more than just a scheduled maintenance.” However, on Wednesday it reported unequivocally that the DoppelPaymer gang had unleashed a ransomware attack on Kia, demanding $20 million in ransom. (Bleeping Computer)

The ransom note and victim contact page

Bleeping Computer said Wednesday that it had seen a ransom note that was allegedly created during the cyberattack on Kia.

The ransom note said its files, backups, and shadow copies would be unavailable to the automaker unless it paid for a decryption tool.

It further threatened that if the company did not respond within three business days, a portion of its data would be made public.

It asked Kia to open links to its personal page (the victim page) using the Tor browser and to follow instructions.

On the victim page, the bad actors said the carmaker’s data had been encrypted and was currently unavailable.

To prevent the leak of the data and receive a decryptor, DoppelPaymer demanded 404 bitcoins worth approximately $20 million. If a ransom is not paid within a specific time frame, the amount jumps to 600 bitcoins, or $30 million.

Kia’s response to Bleeping Computer

Kia denied any evidence of a ransomware attack:

“Kia Motors America, Inc. (“Kia”) is currently experiencing an extended systems outage. (We) are working to resolve the issue as quickly as possible with minimal interruption to our business. We are also aware of online speculation that Kia is subject to a “ransomware” attack. At this time, we can confirm that we have no evidence that Kia or any Kia data is subject to a “ransomware” attack.”

Further developments on this alleged hack are awaited.

Related Story:  Hackers Attack Cybersecurity Firm FireEye And Electronics Giant FoxConn