The attackers used the Ragnar Locker ransomware, that runs only on Microsoft's Windows operating system, to hit Campari, a company with annual revenue of €1.816 billion (A$2.97 billion) revenue in 2017.
DJ Chris Hodson, who runs Hodson Event Entertainment, told iTWire that he had noticed the intrusion into his Facebook page early on the morning of 10 November.
He said the first indication he had that something was amiss was when he received an email from PayPal, informing him that he had been charged for an ad.
He noticed that whoever had got into his page had posted the ad [below, right] about the Campari attack in his news feed and his story feed as well.
Hodson said the miscreants had also made posts which he was able to delete. However the downside was that Facebook shut down his ad account as a result of the intrusion.
He said the ads had been removed from the page, but were still in his ad manager and he was not able to do anything about it.
Hodson runs his business as a sole trader and earns a relatively small amount each year, roughly US$200,000 (A$274,663). The ads would cost him US$150 in toto, of which US$36 has already been taken from his account.
He said he had no tech support of any kind and had been in a quandary as to what he should do when he first got wind of the incident. But he is hopeful that Facebook will accept responsibility for the intrusion and not allow the incident to put a hole in his pocket. The company was prompt in getting back to him when he first contacted them and he is hopeful that they will be swift to sort out the issue equally quickly.
Hodson provides professional party and wedding DJ service for the Chicago area suburbs and beyond, as per his website.
A statement issued by Campari about the attack on its infrastructure said it had occurred on 2 November and resulted in the encryption of data on some of its servers. In a notice posted on the dark web, the attackers claimed they had stole 2TB of sensitive data.
The media release also claimed that the company could not "completely exclude that some personal and business data has been taken". This claim was pooh-poohed by the attackers, who said, "This is ridiculous and looks like a big fat lie. We can confirm that confidential data was stolen and we are talking about a huge volume of data."
They said they would wait until 10 November for Campari's response before leaking data on the dark web.
Asked for his reaction, seasoned ransomware researcher Brett Callow said: "This development is not at all surprising; in fact, it was predictable. Threat actors already issue press releases and do media outreach, so social media ads are simply another way to publicise incidents."
Callow, who works for the New Zealand-headquartered security shop Emsisoft, added: "Their strategy may not be to pressure Campari, but rather to pressure future victims. They probably believe that the brighter the spotlight gets, the more likely it is that other companies will pay in order to satay out of it. And, unfortunately, they may well be right."
