Incident: Garmin Suffers Ransomware Attack Causing Widespread Service Outages

Published Date: 2020-07-24

Postmortem Analysis
Timeline 1. The software failure incident involving Garmin happened in July 2020. [102314, 102245, 103333, 102527, 102512]
System 1. Garmin Connect 2. Garmin website 3. Garmin call centers 4. Garmin communication systems 5. Garmin production systems 6. Garmin aviation database services, flyGarmin 7. Garmin Pilot app 8. Garmin smartwatches and fitness trackers 9. Garmin services such as live track and Garmin Golf 10. Garmin Connect app and website 11. Garmin Connect service synchronization with smartphone apps like Strava 12. Garmin Connect and Strava integration 13. Garmin navigation services 14. Garmin production lines in Asia [Citation: Article 102314, Article 102245, Article 103333, Article 102527, Article 102512]
Responsible Organization 1. Russian cybercriminal group known as Evil Corp [102314, 102245, 102527, 102512]
Impacted Organization 1. Garmin users, including those using GPS and fitness trackers, smartwatches, and aviation navigational equipment [102314, 102245, 103333, 102527, 102512]
Software Causes 1. Ransomware attack by Russian group Evil Corps, specifically using the WastedLocker ransomware, which encrypted Garmin's data and demanded a $10 million ransom [102245, 102527, 102512] 2. Malware sent via email attachments that allowed hackers to take control of Garmin's systems and encrypt their data [103333]
Non-software Causes 1. The failure incident was caused by a ransomware attack carried out by a Russian cybercriminal group known as "Evil Corp" [102314, 102245, 103333, 102527, 102512]. 2. The ransomware attack encrypted Garmin's internal network and some production systems, leading to the shutdown of call centers, website, and online services [103333]. 3. Garmin was allegedly held to ransom by Evil Corp, demanding a reported ransom of $10 million to restore their operation [102245, 102527]. 4. The attack affected Garmin's aviation database services, flyGarmin, and some production lines in Asia [103333]. 5. The ransomware used in the attack was identified as WastedLocker, which is deployed selectively by Evil Corp to target file servers, database services, virtual machines, and cloud environments [102527]. 6. Evil Corp historically targets large organizations such as banks, media companies, and technology firms, using a mixture of technical prowess and social engineering in their attacks [102527]. 7. The ransomware attack led to the encryption of essential files within Garmin's network, disrupting services like Garmin Connect and Strava integration [102527]. 8. The attack was part of a series of ransomware outbreaks by Evil Corp, known for targeting major American corporations and deploying sophisticated malware to extort ransoms [102527].
Impacts 1. Garmin users were unable to record data from their smartwatches, log into Garmin Connect to record health and fitness data, and download up-to-date aviation databases, affecting pilots who use flyGarmin [102314, 102245]. 2. Garmin had to shut down its call centers, website, and some online services, including Garmin Connect, causing inconvenience to users who rely on the service to synchronize their sporting activities with smartphone apps [103333]. 3. Garmin services were slowly restored after being hacked by the Russian cybercriminal group Evil Corp, with some services operating with limited functionality [102527, 102512]. 4. The ransomware attack led to the encryption of essential files, demands for a ransom of around $10 million, and disruption of Garmin's communication systems, affecting customer service and response [102245, 102512]. 5. The attack affected Garmin's aviation database services, flyGarmin, and some production lines in Asia, impacting pilots' ability to download new Garmin software with up-to-date aviation databases, a legal requirement for flying [103333, 102512]. 6. The outage prevented athletes from proving completion of virtual runs, disrupted the ability to track workout data, share routes on Strava, and rank runners using Garmin systems [102245, 102512]. 7. Garmin users expressed frustration over the lack of communication from the company regarding the outage and its impacts on their exercise routines and social interactions related to fitness activities [102245, 102512].
Preventions 1. Implementing robust cybersecurity measures, such as regular security audits, employee training on identifying phishing emails, and ensuring all software is up to date, could have potentially prevented the ransomware attack on Garmin's systems [102314, 102245, 103333, 102527, 102512]. 2. Having a comprehensive backup and disaster recovery plan in place could have helped Garmin quickly recover from the ransomware attack without having to pay the ransom [102314, 102245, 103333, 102527, 102512]. 3. Enhancing communication with customers during the outage and providing regular updates on the situation could have improved customer satisfaction and reduced frustration [102245, 102512].
Fixes 1. Garmin needs to work on restoring their systems and data affected by the ransomware attack, potentially by paying the ransom demanded by the cybercriminal group Evil Corp [102314, 102245, 103333, 102527, 102512]. 2. Implementing stronger cybersecurity measures to prevent future ransomware attacks and ensuring the security of customer data and company systems [102314, 102245, 103333, 102527, 102512]. 3. Enhancing communication with customers to provide updates on the situation, explain the outage, and address frustrations caused by the software failure incident [102314, 102245, 102512]. 4. Conducting a thorough investigation to determine the extent of the data breach, if any, and taking necessary steps to protect customer information [103333, 102527]. 5. Collaborating with cybersecurity experts and law enforcement agencies to track down and hold accountable the cybercriminals responsible for the attack, such as Maksim Yakubets and the Evil Corp group [102245, 102527].
References 1. Garmin company statement - [102314, 103333, 102527, 102512] 2. ZDNet - [102314, 103333] 3. Reuters - [102314] 4. Twitter - [102245, 102512] 5. Bleeping Computer - [102245, 102527] 6. iThome - [103333] 7. Symantec - [102527] 8. NCC - [102527] 9. US Treasury Department - [102245, 102527] 10. FBI - [102245, 102527] 11. US Department of Justice - [102527] 12. US Department of State - [102527] 13. National Crime Agency (NCA) - [102245]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at Garmin: - Garmin experienced a ransomware attack that caused a significant outage affecting its website, call centers, and Garmin Connect service [Article 103333]. - The ransomware attack was believed to have been carried out by a Russian cybercriminal gang known as "Evil Corp" [Article 102527]. - Garmin was targeted by the WastedLocker ransomware, which encrypted essential files and demanded a ransom, similar to the attack experienced by the company [Article 102512]. (b) The software failure incident having happened at other organizations: - Evil Corp, the cybercriminal group behind the Garmin ransomware attack, has a history of targeting banks, media organizations, and technology companies with ransomware attacks [Article 102527]. - Evil Corp has been involved in breaching major American corporations with ransomware attacks, targeting employees working from home [Article 102527]. - The ransomware attack on Garmin is part of a series of attacks on American companies by Evil Corp, showcasing the group's focused and skilled approach to cybercrime [Article 102527].
Phase (Design/Operation) design, operation (a) The software failure incident in the articles was primarily due to the design phase. The incident was caused by a ransomware attack on Garmin's systems, specifically targeting their GPS and smartwatch services. The attack encrypted essential files, rendering them inaccessible to employees and customers. The ransomware used in the attack was identified as WastedLocker, which is deployed selectively by the cybercriminal group Evil Corp [102245, 102527]. (b) The operation phase also played a role in the software failure incident. The attack affected Garmin's call centers, website, and online services, disrupting customer services, including phone lines, online chat, and email. This impacted users' ability to synchronize their sporting activities with smartphone apps to monitor performance. The attack also affected Garmin's aviation database services, flyGarmin, and some production lines in Asia [103333].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident involving Garmin's systems being taken offline due to a ransomware attack is primarily attributed to factors originating from within the system. The attack involved the deployment of the WastedLocker ransomware, which encrypted essential files within Garmin's network, rendering them inaccessible to employees [102314, 102245, 103333, 102527, 102512]. The ransomware attack impacted various services such as Garmin Connect, flyGarmin, and production systems, leading to disruptions in customer services, including call centers, website access, and online chats [102314, 103333, 102527, 102512]. The attack also affected Garmin's aviation database services, hindering pilots from downloading up-to-date aviation databases, which is a legal requirement for flying [102314, 103333, 102527, 102512]. The malware was linked to a Russian cybercriminal group known as Evil Corp, with the attack demanding a ransom of around $10 million from Garmin [102245, 102527, 102512]. The ransomware encrypted company data, and a ransom note was attached to each file, instructing recipients on how to contact the hackers to negotiate the release of their data [102245, 102527, 102512]. Garmin's communication systems were disabled, preventing the company from responding to customer inquiries and exacerbating the impact of the incident [102245, 102527, 102512]. (b) outside_system: The software failure incident involving Garmin's ransomware attack can also be attributed to factors originating from outside the system. The attack was reportedly carried out by a Russian cybercriminal gang known as Evil Corp, specifically led by Maksim Yakubets, who demanded a $10 million ransom to restore Garmin's operation [102245, 102527]. Evil Corp has a history of targeting large organizations, including banks, media companies, and now technology firms like Garmin, indicating external threats to the system [102527]. The ransomware attack was part of Evil Corp's broader campaign to deploy WastedLocker selectively on file servers, database services, and cloud environments, showcasing external threats to Garmin's network security [102527]. Additionally, the attack on Garmin was linked to a broader scheme by Evil Corp to breach multiple organizations, including household names and Fortune 500 companies, through hijacked newspaper websites, highlighting external vulnerabilities exploited by the cybercriminal group [102527].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - Garmin experienced a ransomware attack, specifically by the WastedLocker ransomware, which encrypted the company's data and systems, leading to widespread outages affecting services like Garmin Connect and flyGarmin [102314, 102245, 103333, 102527, 102512]. - The attack impacted Garmin's internal network, production systems, call centers, website, and online services, disrupting services for users such as runners, cyclists, and pilots who rely on Garmin devices [103333]. - The ransomware attack was believed to have been carried out by a Russian cybercriminal gang known as "Evil Corp," with demands for a reported ransom of $10 million to restore operations [102527]. - Evil Corp, the cybercriminal group behind the attack, has a history of targeting large organizations and deploying ransomware selectively to encrypt critical files and demand ransom payments [102527]. - The ransomware attack led to the encryption of essential files within Garmin's network, with the attackers demanding a ransom in exchange for the decryption key [102527]. - The attack was part of Evil Corp's strategy to disrupt operations, extort funds, and potentially cause significant disruption and financial losses to the victim organizations [102527]. (b) The software failure incident occurring due to human actions: - The ransomware attack on Garmin was orchestrated by the cybercriminal group Evil Corp, led by Maksim Yakubets, who is known for his involvement in cybercrime activities and ransomware attacks [102314, 102245, 102527]. - Yakubets, along with his associates, has a history of running cybercrime operations targeting victims outside Russia, using malware to steal money and personal data for financial gain [102245, 102527]. - The attack on Garmin was part of Evil Corp's criminal activities, which involve deploying ransomware to encrypt data, disrupt operations, and extort funds from targeted organizations [102245, 102527]. - Evil Corp's ransomware attacks, including the one on Garmin, are carefully planned and executed to target specific organizations, encrypt critical files, and demand ransom payments for decryption [102527]. - The ransomware attack on Garmin was a result of the deliberate actions of the cybercriminal group Evil Corp, led by Yakubets, to exploit vulnerabilities, infiltrate networks, and disrupt services for financial gain [102245, 102527].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - There is no specific mention in the articles about the Garmin software failure incident being caused by hardware issues. The incident is primarily attributed to a ransomware attack by the Russian cybercriminal group Evil Corp, affecting Garmin's systems and services [102314, 102245, 103333, 102527, 102512]. (b) The software failure incident occurring due to software: - The software failure incident at Garmin was primarily caused by a ransomware attack. The ransomware, known as WastedLocker, encrypted Garmin's data and systems, leading to the disruption of services such as Garmin Connect and flyGarmin. This attack was attributed to the Russian cybercriminal group Evil Corp, specifically led by Maksim Yakubets [102314, 102245, 103333, 102527, 102512].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in the articles is malicious in nature. The incident involved a ransomware attack on Garmin's systems by a Russian cybercriminal group known as "Evil Corp" [102314, 102245, 103333, 102527, 102512]. The attack encrypted Garmin's data, leading to widespread outages affecting services like Garmin Connect, flyGarmin, and production systems. The attackers demanded a ransom of $10 million to restore the operation, and the incident was linked to the WastedLocker ransomware run by Evil Corp. The attack was described as a deliberate act to extort funds from Garmin, causing significant disruption to the company's operations and services. The ransomware attack was part of Evil Corp's history of targeting large organizations, including banks and technology companies, for financial gain. The incident was characterized by the deliberate encryption of essential files and the demand for payment in exchange for decryption keys. (b) The software failure incident was not non-malicious; it was a deliberate act of cybercrime aimed at disrupting Garmin's operations and extorting funds from the company [102314, 102245, 103333, 102527, 102512]. The attack impacted Garmin's ability to provide services to its customers, leading to outages in services like Garmin Connect and flyGarmin. The incident caused frustration among users who relied on these services for tracking fitness activities and sharing data. The attack was orchestrated by a cybercriminal group with a history of targeting major organizations for financial gain, indicating a malicious intent to harm Garmin's systems and operations.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident: - The software failure incident involving Garmin was a result of a ransomware attack carried out by a Russian cybercriminal group known as "Evil Corp" [102314, 102245, 103333, 102527, 102512]. - Evil Corp demanded a ransom of $10 million from Garmin to restore their operation [102245, 102527]. - The attack encrypted Garmin's internal network and some production systems, leading to the shutdown of call centers, website, and online services [103333]. - The ransomware used in the attack was identified as WastedLocker, which is selectively deployed by Evil Corp to target specific systems like file servers, database services, virtual machines, and cloud environments [102527]. - The attack disrupted essential services like Garmin Connect, affecting users' ability to synchronize their sporting activities with smartphone apps [103333]. - Garmin's communication systems were disabled, preventing the company from responding to customers and resolving the issue promptly [102245]. - The attack led to a significant impact on Garmin watch owners who rely on services like Garmin Connect to track their fitness activities [102512]. - The ransomware attack was a deliberate act by the cybercriminal group to extort funds from Garmin by encrypting essential files and demanding a ransom for decryption [102527]. - The attack affected Garmin's aviation database services, flyGarmin, and production lines in Asia, causing disruptions in services like the Garmin Pilot app used for flight planning [103333]. - The ransomware incident was part of Evil Corp's history of targeting large organizations, including banks and technology companies, to extract significant ransoms [102527]. - The attack on Garmin was part of Evil Corp's strategy to cripple the victim's network, disrupt operations, and demand a costly ransom payment [102527].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development_incompetence: - The software failure incident involving Garmin was due to a ransomware attack carried out by a Russian cybercriminal group known as "Evil Corp" [102245, 102527]. - Garmin's systems were encrypted by the WastedLocker ransomware, which was linked to Evil Corp [102527]. - Evil Corp has historically targeted large organizations like banks, media companies, and technology firms, showcasing their technical prowess and social engineering skills [102527]. - The attack on Garmin was part of Evil Corp's focused and selective approach in targeting significant organizations [102527]. - The ransomware attack on Garmin led to the encryption of essential files and a demand for a ransom in exchange for the decryption key [102527]. (b) The software failure incident occurring due to accidental factors: - The ransomware attack on Garmin was not accidental but a deliberate act by the cybercriminal group Evil Corp [102245, 102527]. - The attack involved deploying the WastedLocker ransomware in a targeted manner, indicating a deliberate and calculated approach [102527]. - Symantec identified a possible route of infection for Garmin through hijacked newspaper websites hosting malware, suggesting a deliberate strategy by the attackers [102527]. - Evil Corp's deployment of WastedLocker was strategic and aimed at causing significant disruption and extracting ransom payments from victims [102527].
Duration temporary The software failure incident involving Garmin was temporary. The incident lasted for several days, with Garmin services being offline for at least five days due to a ransomware attack by the Russian cybercriminal group Evil Corp [102314, 102245, 103333, 102527, 102512].
Behaviour crash, omission, other (a) crash: The software failure incident in the articles can be categorized as a crash behavior. Garmin's systems were entirely offline for more than three days due to a ransomware attack, causing a significant impact on the company's operations and services [Article 102527]. (b) omission: The software failure incident also involved omission behavior as Garmin's services, including the official website, customer services, and Garmin Connect, were shut down, leading to the omission of performing their intended functions such as synchronizing sporting activities for users [Article 103333]. (c) timing: The timing behavior is not explicitly mentioned in the articles as a specific aspect of the software failure incident. (d) value: The software failure incident did not involve a value behavior as the system was not mentioned to perform its intended functions incorrectly. (e) byzantine: The software failure incident did not exhibit a byzantine behavior as the system's responses and interactions were not described as inconsistent or erroneous. (f) other: The software failure incident can be further described as a ransomware attack that encrypted essential files, demanded a ransom for decryption, and disrupted various services and functionalities of Garmin's systems, leading to a widespread outage and impact on users [Article 102245, Article 102314, Article 102512].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, delay, non-human, theoretical_consequence (a) death: People lost their lives due to the software failure - There is no mention of any deaths resulting from the software failure incident reported in the articles. (b) harm: People were physically harmed due to the software failure - There is no mention of people being physically harmed due to the software failure incident reported in the articles. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted due to the software failure incident reported in the articles. (d) property: People's material goods, money, or data was impacted due to the software failure - Garmin users were unable to record and analyze their health and fitness data, and pilots were unable to download up-to-date aviation databases, which is a legal requirement [102314]. - Garmin services, including Garmin Connect, were down, impacting users' ability to synchronize their sporting activities with smartphone apps [103333]. - Garmin services were slowly returning after being hacked, affecting users' ability to upload data from fitness trackers [102512]. (e) delay: People had to postpone an activity due to the software failure - Runners and cyclists were unable to upload data from their latest workouts due to the Garmin Connect service being offline [103333]. - Athletes were unable to prove they completed virtual runs due to the outage, impacting their ability to submit GPS data to organizers [102512]. (f) non-human: Non-human entities were impacted due to the software failure - Garmin's production line in Taiwan was believed to have been affected by the software failure incident [102314]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incident had significant consequences, as detailed in the articles. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The potential consequences discussed included the impact on Garmin's services, aviation databases, and production lines, as well as the potential loss or theft of customer data [102314, 103333, 102527]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - There were no other consequences mentioned in the articles beyond those related to user data, service disruptions, and potential financial impacts.
Domain information, utilities, government (a) The failed system was intended to support the information industry. The Garmin Connect service, which allows users to upload data from fitness trackers to Garmin and other services like Strava, was affected by the ransomware attack, impacting the ability of users to synchronize their sporting activities [Article 103333]. (g) The failed system also impacted the utilities industry. Garmin Aviation's flyGarmin website and mobile app, used for aviation databases, were down due to the ransomware attack, affecting pilots' ability to download up-to-date aviation databases, which is a legal requirement for flying [Article 102314]. (l) Additionally, the government sector was affected by the software failure incident. The ransomware attack on Garmin, believed to be carried out by the Russian cybercriminal group Evil Corp, led to a significant impact on Garmin's internal network and some production systems, resulting in the shutdown of call centers, website, and other online services [Article 103333].

Sources

Back to List