Medical and military contractor Kimchuk hit by data-stealing ransomware

Kimchuk, a medical and military electronics maker, has been hit by data-stealing ransomware, TechCrunch has learned.

The Danbury, Conn.-based manufacturer, which builds electronics for medical equipment, telecoms systems and energy grids, also makes nuclear modules for the Navy, work that often requires security clearance.

Its systems were infected and knocked offline earlier this month by DoppelPaymer, a newer strain of ransomware that exfiltrates data out of an infected network before encrypting user files. If a victim doesn’t pay the ransom to decrypt their files, the DoppelPaymer group will begin publishing the contents of their victim’s network.

When the company did not pay, the hackers began publishing portions of Kimchuk’s network.

The files included the company’s payroll records, broker approvals and purchase orders. None of the files we reviewed contained information marked as classified. But several documents contained order details of one of its customers’ nuclear divisions.

It isn’t known precisely when the ransomware attack happened. But a screenshot of a directory of stolen files seen by TechCrunch puts the most recent file at March 5, suggesting the attack happened on or around then.

TechCrunch contacted Kimchuk for comment. Kimchuk chief executive Jim Marquis responded to our email — without taking us off the email chain — instructing his human resources and operations chiefs to “not respond” to our email or questions.

“If he persists, state ‘no comment’,” Marquis wrote. “How did he learn of this?”

We followed up, asking Marquis if he wanted to provide a fuller statement. TechCrunch did not hear back.

Given the breach happened on a government supply chain, we contacted the Dept. of Defense. When reached, a spokesperson did not comment.

Kimchuk is the latest company to be hit by the DoppelPaymer ransomware. Earlier this month, Visser, a defense contractor and parts manufacturer — which has Tesla and SpaceX as customers — was also hit by DoppelPaymer and had files published online after the company declined to pay the ransom.

The DoppelPaymer ransomware group has been active since the middle of last year, drawing inspiration from other data-stealing ransomware, like Maze, said Brett Callow, a threat analyst and ransomware expert at security firm Emsisoft. But unlike Maze, he said, DoppelPaymer’s ransom note does not say that data has been stolen. Instead, it’s only disclosed if the company goes to the ransomware’s website to pay.

“Ransomware incidents should be treated as data breaches until it can be established they are not,” said Callow.

Got a tip? You can send tips securely over Signal and WhatsApp to +1 646-755–8849.