Appliance repairer in the dark after ransomware attack on F&P Appliances

Tuesday, 16 June 2020

A Kāpiti Coast appliance repairer has a backlog of jobs and a lot of unhappy clients after a ransomware attack hit Fisher & Paykel Appliances.

The Auckland-based whiteware maker, owned by China's Haier, was recently targeted by a malware program called Nefilim. Other companies to fall victim to the ransomware programme included Australia's Toll Holdings and brewer Lion, and Japanese car maker Honda.

Gibbs Appliance Repair owner Michael Gibbs said the first he knew of the problem was in early June when he tried to order parts for a customer.

He only found out about the ransomware attack when a customer told him.

Appliance repairer Michael Gibbs is in the dark about F&P Appliance parts after the ransomware attack.

* Fisher & Paykel Appliances ceo to step down

* Auckland couple's 'treasured' wringer washer has lasted at least 50 years - and counting

'All I got was my parts order, the first one I did was never confirmed through their email system, that was my first trigger - so I called them, they said it would be a couple of days.'

Gibbs called Fisher & Paykel Appliances on June 4, and according to the parts system the order was going to be sorted by June 8.

'Then as the 8th of June came and passed, it just said we are currently experiencing a system outage, keep an eye on this and we'll let you know.

'In the meantime, that's it - we've had no correspondence from Fisher & Paykel at all, just an inability to order parts.'

He generally had about 15 to 20 customers a week needing parts for their Fisher & Paykel appliances.

Ordinarily Fisher & Paykel's parts system was the best across the board, Gibbs said.

'I've got a lot of customers with fridges and ovens and all sorts that I can't get parts for - it's very, very awkward for customers and of course I'm wearing it in the neck for taking so long,' Gibbs said.

'It's not my fault however, and I'm one of many, many companies in the country, in New Zealand and Australia, I would guess, that would be hanging out waiting for parts.

'I understand, these things happen, so I haven't put Fisher & Paykel under the bus, I've just said their system's been offline, and they're trying to recover it as soon as possible, and as soon as they do I can reorder parts - but until such time, my hands are tied.'

The ordering page was still offline on Tuesday morning, he said.

'The problem I had originally was I told customers they were hoping to have it on by 8th of June and then we're good to go, and of course I've had to make countless phone calls again to say, afraid not.'

Other parts could not be substituted - every company had their own parts for their own machines.

'The biggest problem hasn't been the oddball parts, it's actually been the common parts, I ran out really quick,' Gibbs said.

'I'm currently in need of multiple elements, multiple electronics for dishdrawers and dishwashers, fridges, oven elements, oven door hinges, and of course they're all specific - you can't use generic parts.'

Ordinarily Fisher & Paykel's parts system was the best across the board, compared with other appliance companies, he said.

'Normally I order parts via their system and it's delivered the next day, marvellous. It slowed down over Covid, but that was the couriers rather than Fisher & Paykel.'

A spokesman for Fisher & Paykel Appliances said there was no update on the situation. Order fulfilment was back up and running, although there was a backlog, he said.

Last Thursday, threat analyst Brett Callow at IT security company Emisoft said the hackers had posted online financial information stolen from Fisher & Paykel in what appeared to be a bid to increase the pressure for a ransom.

However, if they had any customer information, that was not released.

Cyber security organisation Cert NZ issued an advisory earlier on Tuesday warning about an active ransomware campaign targeting networks through remote access systems.

'The current attacks are believed to be sophisticated and well crafted,' Cert NZ said.

'These attacks can have severe impacts on business operations, including data being stolen and sold.

'Recovery from these attacks requires significant investment to fully investigate and remediate the network compromised, and restore encrypted files from backup.'

Attackers were gaining access through vulnerable remote access technologies, such as unpatched software, weak authentication, or a lack of multi-factor authentication.

Citrix remote access technologies had been reported as a common way for attackers to gain access, Cert NZ said.