Spain leads fight against ransomware gangs as Majorcan mayor refuses to pay €10 million ransom

The Mayor of Calvià, a popular tourist destination on the Spanish island Majorca, is refusing to pay a rumoured €10 million ransom after being hit by a ransomware attack. And according to all the experts I’ve spoken to, that’s the best possible move.

While the group behind the attack has yet to be confirmed (word on the cyber-street is that LockBit could be responsible), Mayor Juan Antonio Amengual has stated that the ransom won’t be paid under any circumstances. 

Government entities, including municipal councils, are now a popular target among ransomware and data extortion groups. The lure of a double-whammy payload – theft of sensitive data plus essential services disruption – has proven too tempting, it seems. 

The attack “highlights the difference between ransomware targeting a business versus a city council,” says Joseph Carson, Chief Security Scientist & Advisory CISO at Delinea.

“The impact hits everyone who lives in that city and beyond and generates a ripple effect on many sectors, including the tourism industry,” he adds.

Carson points out that the cybercriminals have not timed their attack for maximum impact, however, as the “consequences would have been disastrous if this ransomware group had attacked during the summer season”.

Related: LockBit ransomware: its history, its present and why you must be ready for it

Spain fights back

“Calvià is showcasing Spain’s dedication to the Counter Ransomware Initiative (CRI),” says Dr Darren Williams, CEO of Blackfog. “While it often seems like giving in to extortion demands is the easiest and fastest way to recovery, organisations and government entities need to collectively focus on preventative technologies such as anti-data exfiltration that stop attackers before it’s too late.”

Martin Mackay, CRO at Versa Networks, points out that Spain signing up to the CRI “would have been completely meaningless had local governments started to pay extortion fees as soon as they were hit by ransomware”. 

Inevitably, Calvià will face short-term disruption to administration services. In the long term, however, it will pay off, says Mackay. “Paying ransom demands is no guarantee that access to systems or stolen data will be returned, and it will only help fund future ransomware activity,” he says.

“If ransomware actors are unable to profit from victims paying ransom demands, then their attack has ultimately failed. Therefore, it is essential that both governments and private businesses in similar situations do the same as Calvià and refuse to pay any extortion fees set by ransomware actors.”