SnapFulfil

Summary

SnapFulfil, a UK cloud-based warehouse management software provider, experienced a ransomware attack disrupting customer warehouse operations and order processing, with some orders valued at significant amounts. The company collaborated with national law enforcement and cybersecurity agencies to restore systems, implementing additional security measures to prevent future incidents. Most customers resumed normal operations following the attack, which exhibited characteristics of drive-by ransomware potentially initiated through infected email attachments.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In mid-August 2020, UK-based warehouse management software provider SnapFulfil, operating under Synergy Logistics, experienced a ransomware attack disrupting its cloud-based services. Internal communications dated late the previous week, shared with media, confirmed the incident originated from a ransomware operator targeting company systems. Initial customer notifications stated the firm believed its data remained secure despite the compromise. Technical remediation efforts during the immediate response period included implementing additional security controls and system modifications to prevent recurrence. While subsequent communications referenced a potential second attack, this was later clarified as an erroneous statement made during the crisis rather than an actual repeat intrusion. Forensic indicators suggested the attack vector resembled drive-by ransomware, commonly delivered through mechanisms like malicious email attachments. The incident caused immediate operational paralysis for dependent warehouse clients.

At least one SnapFulfil customer reported severe logistical disruptions, describing the system outage as a "total nightmare" that prevented processing customer orders, including high-value transactions worth thousands of pounds. Synergy Logistics engaged the UK National Crime Agency and National Cyber Security Centre to coordinate system restoration and impact mitigation. By August 20, 2020, the company confirmed most customers had resumed normal operations following service recovery efforts. Post-incident safeguards were deployed to reduce future attack risks, though specific technical measures remained undisclosed. The attack highlighted ransomware threats to supply-chain software providers, demonstrating operational dependencies even for non-enterprise clients. No public confirmation was provided regarding ransom payment demands or data exfiltration claims.

Sources

Sources available to members: 1 source.