IT services giant Sopra Steria has announced that last month’s cyber attack on its systems is likely to cost the company up to €50 million.
In an update published on its website, the NHS supplier admitted that the ransomware attack would negatively impact its gross operating margin by between €40 million (£35.6m) and €50 million (£44.5m).
The French company also revealed that its insurance coverage for cyber risks totals €30 million (£26.7m). IT Pro contacted its representatives about the details of the insurance coverage but is yet to hear back from the company.
Sopra Steria stated that the large costs of the cyber attack, a new variant of the infamous Ryuk ransomware, can be attributed to “the remediation and differing levels of unavailability of the various systems since 21 October”, the day when the incident was detected.
However, the IT services giant added that “sales activity for the fourth quarter should not be significantly affected by this event”.
“For financial year 2020, Sopra Steria expects to see negative organic revenue growth of between 4.5% and 5.0% (previously “between -2% and -4%”), an operating margin on business activity of around 6.5% (previously “between 6% and 7%”), and free cash flow of between €50 million and €100 million (previously “between €80m and €120m”),” it said.
Ryuk is a popular strain of malware which last month was reported to be targeting some 20 organisations a week as well as forcing a number of US hospitals offline. It is believed to have compromised Sopra Steria's Active Directory infrastructure and encrypted portions of the company's network.
However, according to the company, the attack was “rapidly blocked thanks to in-house IT and cyber security teams”.
“The measures implemented immediately made it possible to contain the virus to only a limited part of the Group’s infrastructure and to protect its customers and partners,” it added.
Sopra Steria also confirmed that the incident had not caused any further breach of data, saying that it had not identified “any leaked data or damage caused to its customers’ information systems”.
Since the cyber attack, the company has managed to restore access to its workstations, R&D and production servers, in-house tools and applications, as well as customer connections.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
300 days under the radar: How Volt Typhoon eluded detection in the US electric grid for nearly a yearAnalysis Lengthy OT lifespans give attackers time to penetrate networks underpinning critical infrastructure and plan future disruption
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
