Cyber Incident Victim: Nygard
Date:
Dec 2020
Location:
Canada
Summary
A ransomware attack targeted the organization's IT systems, compromising electronic records, programs, and infrastructure. Attackers encrypted data and demanded payment for decryption, leaving instructions warning against unauthorized recovery attempts. IT staff and third-party consultants mitigated the incident, preventing permanent data loss from approximately 46 servers but failing to restore four encrypted servers. The breach occurred during ongoing efforts to recover systems from an earlier power outage. The organization's court-appointed receiver oversaw response efforts while assessing the full impact of the attack.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On December 12, 2020, a ransomware attack compromised the IT systems of Nygard's organization during ongoing recovery efforts from an unrelated November power outage. The attack occurred while Informanix (a third-party IT consultant) and Nygard IT staff were working to restore digital records and servers affected by the earlier outage. At 8:30 PM CST that day, the court-appointed receiver Richter Advisory Group Inc. became aware of the breach after attackers encrypted data and left instructions warning against unauthorized recovery attempts. The malware compromised electronic records, programs, and IT infrastructure across the organization, including systems belonging to debtors. Attackers demanded payment for decryption tools, explicitly stating that manual recovery attempts could cause permanent data damage.
The incident resulted in four servers becoming irrecoverably encrypted despite response efforts. IT staff containment actions on December 12 prevented permanent data loss from approximately 46 additional servers that would have been affected without intervention. Richter Advisory Group reported the attack in a December 30 court filing while IT teams continued assessing damage severity and developing backup strategies for compromised files. This cybersecurity event occurred amid parallel legal proceedings against Peter Nygard, who faced arrest on December 14, 2020, under a U.S. indictment for racketeering and sex trafficking charges unrelated to the breach. The ransomware attack further complicated asset management by the court-appointed receiver during Nygard's detention at Winnipeg Remand Centre.