In October 2020, Matson, a leading U.S. shipping company, fell victim to a **ransomware attack** executed by the **REvil (Sodinokibi/Sodin) hacker group** at its Oakland, CA operations. The attack resulted in the **full encryption of all company servers and files**, crippling critical business systems. The hackers demanded a ransom, imposing a **72-hour deadline** before doubling the payment amount. The incident severely disrupted Matson’s operations, including cargo processing, logistics, and internal communications. While the company worked to restore systems from backups, the attack caused **significant operational downtime**, financial strain from potential ransom negotiations or recovery costs, and reputational damage due to public exposure of the breach. The encryption of **all company data**—including proprietary, financial, and operational records—posed an existential threat to continuity, aligning with high-severity cyber incidents where core business functions are compromised.
TPRM report: https://www.rankiteo.com/company/matson-inc
"id": "mat613092125",
"linkid": "matson-inc",
"type": "Ransomware",
"date": "10/2020",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Shipping/Logistics',
'location': 'Oakland, CA, USA',
'name': 'Matson',
'type': 'Company'}],
'data_breach': {'data_encryption': True},
'date_detected': '2020-10',
'description': 'Shipping company Matson was hit by a ransomware attack in '
'Oakland, CA, in October 2020 by the REvil hacker group '
'(Sodinokibi/Sodin), resulting in the encryption of all the '
"company's servers and files. Hackers gave the company 72 "
'hours to pay the ransom or the price would be doubled.',
'impact': {'systems_affected': ['Servers', 'Files']},
'motivation': 'Financial Gain',
'ransomware': {'data_encryption': True,
'ransomware_strain': ['REvil', 'Sodinokibi', 'Sodin']},
'threat_actor': 'REvil (Sodinokibi/Sodin)',
'title': 'Ransomware Attack on Matson by REvil (Sodinokibi/Sodin)',
'type': 'Ransomware Attack'}