Street newspaper appears to have Big Issue with Qilin ransomware gang

The parent company of The Big Issue, a street newspaper and social enterprise for homeless people, is wrestling with a cybersecurity incident claimed by the Qilin ransomware gang. In a post made to the gang's leak site, the miscreants claim to have stolen 550 GB of company data and, according to what they've released already, …

[Lon24]

What is the purpose?

The ability of the Big Issue to pay a meaningful ransom is near zero. That doesn't take a great deal of research to determine. Just emplying "an IT expert" (note the singular) will make a dent in their cashflow. Dealing with ICO will consume considerable management resources. Ransomware gangs are not stupid people. They expect to be paid in either money or favours by someone. Who is this someone?

Don't answer 'cos it would only be a conspiracy theory ... sadly.

[simonlb]

Re: What is the purpose?

I suspect that both the CEO's mentioned in the article are on six figure salaries (seems to be the norm these days for charities), but the bigger question is why they are engaging with external IT security experts? Don't they have any internal ones? Or is there no budget for those after paying the CEO salaries?

Yes, attacking a charity is majorly scummy, but if the data was that easily exposed it does raise serious questions about the priorities and management of the charity if their IT is so easily compromised.

[Lon24]

Re: What is the purpose?

From the 2020 accounts:

"Key management personnel include the Trustees, the CEO and those reporting to the CEO (namely: National Services Director). Remuneration paid to these individuals amounted to £123,140 (2019: £131,154)."

Which would suggest the CEO was in the lower/mid 5 digit market. I doubt they have a full time IT department. Yes, they may be a sitting duck. Attractive, maybe, to a script kiddie - but to a serious ransom-seeking gang? Doesn't make sense.

[doublelayer]

Re: What is the purpose?

The model of letting someone else get initial access and then just deploy your ransomware could be responsible. If there is someone who wants to get some ransoms but isn't capable of getting into anything with even mild protections on it, they may have been the one to select some low-hanging fruit because they could get into it and they didn't really think about the likelihood of getting anything out of it. Having done so, the software worked just as well as it would anywhere else and the organization responsible for collecting ransoms figured that they've already attacked this thing, so might as well try to get some money for it even if it's small.

[Anonymous Coward]

The big issue was originally for homeless people to sell. That then changed and it became a job for Roma gangs who pick up the women who are not homeless and drive them to the locations. Whilst the big issue has a charity foundation part it is a for profit business and it no longer helps people off the streets or actual homeless people which was it's original aim. Not condoning the actions of any scummy ransomware gang but I think these facts need to be clear. I wouldn't compare them to hospitals or other legitimate charities.

[Anonymous Coward]

That's my experience also. I've seen them in Cambridge and they all have similar signs (presumably made by the same person) and they are stationed every few hundred yards. I've spoken to a few of them and they live in houses and take the train every day to sell Big Issue. It's not the same as it used to be, and the articles are mostly drivel now. Used to be an interesting read.

[Robert Carnegie]

Don't buy it from a Roma then. Solved. They only get half of the price, anyway.

I'm not a regular reader, but I think I bought it last month off the shelf in the Co-operative supermarket. I don't mind supporting Co-operative.

[Anonymous Coward]

I honestly don't care about the Roma part. I care about the fact they don't get people off the streets and let people not on the streets sell it allowing these gangs to take the piss. They only get half the price, the half they don't have to put up front to get it in the first place. Without getting people of the street it's no better than begging and giving people money to get high (that's if it is actually homeless people). You might as well just give a beggar 1.25 and be done with it. What exactly is the point of it? How is it actually helping people? It's no better than chuggers now.

[Robert Carnegie]

A definition of "homeless" is used which doesn't mean "slept in a gutter last night / will sleep in a gutter tonight".

Imagine that I let a homeless person sleep in my garage overnight. Do they thus become not homeless? And therefore not eligible for other consideration?

How about if they sleep on my kitchen floor?

I don't take an objection to supporting people who don't have a right to sleep somewhere, or who only very recently acquired one. It isn't a time to cut someone off.

I also don't object to buying a magazine from W H Smith or from Baron Sainsbury, who are not even slightly homeless.

I have a separate response to beggars which includes not taking responsibility myself for a decision to support them or not. Let's say that I toss a coin to decide it, but not while they're looking.

We have collectively been sneering at and suspecting beggars certainly since Sherlock Holmes's "The Man with the Twisted Lip" of 1891, in which a wicked man indeed commutes by train to the best begging territory, until an innocent person finds him out. It's not really credible then or now, particularly as he passes by a drug house every day which must be making a lot more money - it's in central London after all. Or what about Lazarus in the bible who just sat outside the rich guy's house all day, the lucky sod.

[Anonymous Coward]

It's not a case of sneering or suspecting beggars. I have zero issue and will always ensure they have some food and offer. Sadly a lot of people who are homeless have issues with addiction, we can't get away from that but what we can do is put things into place to help them. The big issue is not doing that. It is just indirectly giving them money while taking money for itself. This is just my opinion of what I see and of someone who many years ago was in that position. You could argue homeless hostels mean you are no longer homeless but trust me with some of them you would rather be on the street.

[Anonymous Coward]

Not really the point.

This sums it up nicely.

https://nickbuckleymbe.substack.com/p/the-big-issue-the-big-con-that-gets

We've got one in our local town. A lovely Romanian lady who we often have a chat with. But basically can't be bothered to get a proper job, or being forced to do it. There's plenty of actual work available in a cafe or as a cleaner for example, but this pays better just to stand around all day. She only has to sell around 4 per hour to make more than minimum wage.

[Anonymous Coward]

Storing personal details including bank accounts on spreadsheets is not ok in a micro business, never mind a national-scale organization.