Qilin ransomware gang claims cyber attack on the Big Issue

A ransomware gang known as Qilin has come forward to claim responsibility for breaking into the IT systems of UK-based publisher and social enterprise the Big Issue Group and stealing confidential data.

According to screengrabs of the gang’s dark web leak site seen by Computer Weekly, Qilin claims to have stolen 550GB of the Big Issue Group’s data, including personnel information, contracts and partner data, financial statements and investment information.

A number of additional screenshots posted to prove the veracity of its claims appear to comprise personal addresses and employee details, including passport scans, payroll information and a recent letter approving a pay rise for a senior executive.

Qilin’s posting, which seems to have been made on 23 March, did not set a deadline or demand a specific ransom, although it did accuse its victim of wanting to “hide the fact of hacking and leakage of personal data”.

Paul Cheal, group CEO of the Big Issue Group, confirmed the organisation had experienced a cyber security incident in the past week.

“On becoming aware of this, we took immediate steps to restrict access to our systems, working with external IT security experts, and the investigation into the incident is ongoing. Thanks to the proactive steps taken, we have been able to begin restoring our systems and are operating with limited disruption. The publication and distribution of the Big Issue magazine is not impacted by this incident,” said Cheal.

Cheal additionally confirmed that as part of the investigation, the group has identified that some data related to the organisation has been posted to the dark web by the attackers. The Big Issue Group is now working alongside external IT experts, as well as the National Cyber Security Centre (NCSC), the National Crime Agency (NCA), and the Metropolitan Police, and has notified the relevant regulatory authorities.

“[We] would like to thank our staff, partners and suppliers for their patience whilst our investigation continues,” said Cheal. “This is a criminal act against our social activities and the causes we work to promote.

“We exist to support those living at the sharp end of poverty, who are facing barriers to opportunity. Critically, our staff are continuing to support our vendors to earn a living by selling the Big Issue magazine, whilst also providing frontline support for vendors with access to advice and services, alongside making social impact lending available to social enterprises and other organisations we work with, ensuring we continue to deliver against our mission to change lives through enterprise.”

The Big Issue was set up in 1991 as a street newspaper sold by homeless people in London, offering them a chance to earn a legitimate income as a first step to putting their lives back together.

The brainchild of entrepreneur, campaigner and life peer John Bird, who experienced homelessness as a young man in the 1960s, and business partner Gordon Roddick, husband of Body Shop founder Anita Roddick, the Big Issue has since expanded into one of the UK’s foremost social enterprises advocating for homeless people and those at risk of becoming homeless.

In addition to publishing a weekly magazine focusing on campaigning and political journalism, it also runs a charitable foundation and an investment arm that supports other charities and non-governmental organisations.