Exact details about the nature of the latest incident are not fully known by The Sydney Morning Herald and The Age, but Mr Irvine told staff the second attack was anticipated and that the company had contracted multinational professional services company Accenture to assist it in recovery efforts.
It comes as industry news website iTWire reported that hackers used the REvil ransomware to attack the company and were demanding $US800,000 ($1.16m) to decrypt the company’s files. In addition to locking up a company’s files and crippling their IT systems, ransomware will often leak files on the dark web in small amounts as a bargaining tactic if a victim does not pay by the deadline.
Asked about the ransom amount reported by iTWire, a spokeswoman said on Wednesday: “We have confirmed that Lion was the victim of a cyber attack, caused by ransomware. We are not in a position to provide any further comment.” On Thursday evening, the spokeswoman also refused to comment on the staff briefing or on the nature of the second attack, referring to Wednesday’s statement.
The initial attack caused multiple supply issues across its business and has shaken the company, which employs approximately 7000 people across Australia. It comes as its dairy and drinks business, which employs 2300 workers, is the subject of a $600 million takeover bid from Chinese dairy giant Mengniu, part-owned by Chinese state-owned food processor COFCO.
The Foreign Investment Review Board is assessing the bid after the ACCC gave the offer the green light in February. Federal Treasurer Josh Frydenberg will have the final say over the sale.
Since the initial incident on June 8, the company has been providing periodic updates on its website about the attack and how it has affected supply across Australia. Its last update was on Monday when it said its IT teams and expert cyber advisers had “continued working throughout the weekend to investigate this incident, working to bring systems back online safely”.
“We have made good progress, however, there is still some way to go before we can resume our normal manufacturing operations and customer service.”
Across its Australian and New Zealand adult beverages businesses, it said it continued “to have limited visibility of our products in our systems. We’re working to bring our breweries back online as soon as possible, hoping to get a number of our breweries back up and running very soon”
“We apologise to our consumers and customers, especially those who are only just getting their own venues back up and running following COVID-19 closures. We thank them for their patience as we do everything we can to get back to normal supply levels.”
Impacts on Monday included a number of temporary shortages or out-of-stock items across both packaged (bottle/can) and keg brands. “While our systems are offline, we have worked very hard to be able to supply a limited number of key products to our customers,” it said. “We will continue to accept and fulfil orders as best we can, using interim manual processes where we need to.”
Its Dairy & Drinks Business was also continuing to experience interruptions at sites across its manufacturing network and some parts of its customer service systems remained offline.
“Unfortunately, due to the nature of fresh dairy and juice products we have experienced some service misses across our customers. We are continuing to do all we can to service customer demand, including having our people work with customers to assist with manual ordering and delivery and moving to manufacture different products at our various dairy sites across the network.”
It added that there remained “no evidence that any of the information contained in our system (including financial or personal information) has been affected. This is something that we will continue to review closely as part of our ongoing investigations.”
Get our Morning & Evening Edition newsletters
Ben Grubb is a Desk Editor/Locum Homepage Editor for The Sydney Morning Herald.