Ransomware Targets The Weather Network, Threatens Leak

The Russian ransomware group LockBit is threatening to release internal data from Pelmorex, the parent company of The Weather Network, on the dark web.

The threat follows a cyberattack that disrupted the Canadian company’s operations for several days last week. Pelmorex, based in Oakville, Ontario, owns The Weather Network, MétéoMédia, El Tiempo in Spain, plus also manages Canada’s AlertReady system.

“Based on everything we know thus far, the attackers obtained limited access to publicly available information,” said Karen Kheder, director of communications and administration at Pelmorex, speaking to The Globe and Mail.

LockBit has advertised that it possesses databases from Pelmorex’s network, including codes to the company’s digital servers. The group plans to publish the data on September 24, according to its dark web domain.

Kheder declined to comment on whether a ransom has been demanded, stating, “If there is any change or update to our findings, we will notify all relevant parties in accordance with the law.”

LockBit operates using a ‘ransomware as a service’ business model, where hackers often act independently but may share a portion of the ransom with the group. According to Canada’s Communications Security Establishment, LockBit was responsible for at least 22% of all ransomware attacks in Canada last year, making it the most frequent digital threat.

Pelmorex has engaged the Royal Canadian Mounted Police (RCMP) to investigate the breach, which is said to be “connected to a third-party software provider.” The RCMP has not commented on the investigation.

Kheder stated that most of Pelmorex’s operations have been restored and that their apps and systems are safe to use. However, she warned that users may experience “occasional system downtimes and glitches” as the company works to return to normal operations.

Pelmorex is urging Canadians to update their Weather Network apps and has apologized for the inconvenience caused by the incident.