Cyber Incident Victim: Asbis
Date:
Apr 2021
Location:
Czechia
Summary
The Czech branch of electronics and IT distributor Asbis suffered a ransomware attack by the Avaddon group, resulting in stolen and encrypted internal data alongside paralyzed systems. Threat actors demanded payment to prevent data publication and threatened additional disruption via DDoS attacks, but the company refused negotiations while collaborating with law enforcement. The attackers publicly listed the organization on their leak site and released sample exfiltrated files to substantiate their claims, though recovery efforts were underway to restore operations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early April 2021, the Czech branch of Asbis, a distributor of consumer electronics and IT products across Central and Eastern Europe, suffered a ransomware attack by the Avaddon threat actor group. The attackers infiltrated Asbis CZ’s systems, exfiltrated internal data, and encrypted files, paralyzing internal operations. Avaddon subsequently issued a ransom demand, threatening to publish the stolen data and launch a DDoS attack to further disrupt the company if payment was not made. The group listed Asbis CZ on their dedicated leak site, where they posted samples of allegedly stolen files as proof of their access. Asbis CZ’s CEO, Petr Jandik, publicly confirmed the attack in an interview with ChannelWorld, emphasizing the company’s refusal to negotiate with or pay the threat actors. The company engaged law enforcement, including Czech police, and collaborated with relevant authorities to investigate the incident and mitigate its effects.
The attack disrupted Asbis CZ’s internal systems, impairing operational continuity, though the full scope of encrypted or compromised data was not detailed publicly. Avaddon’s leak site claims indicated the exfiltration of sensitive internal information, escalating reputational and operational risks. Despite the dual threats of data exposure and potential DDoS attacks, Asbis maintained its non-compliance stance, focusing instead on system recovery and forensic efforts. No subsequent reports confirmed whether Avaddon executed their DDoS threat or released additional data beyond the initial samples. The company’s response prioritized restoring systems through coordinated recovery measures while avoiding concessions to the attackers. The incident underscored the persistent ransomware threats facing IT supply chain entities and highlighted Asbis CZ’s reliance on law enforcement collaboration to manage the crisis without financial capitulation.