Latam · November 10, 2019 · 4 min
Pemex: DoppelPaymer asked for $4.9 million. The oil company said the crude kept flowing
MedellínSoftware · Medellín, Colombia
November 2019. The ransomware hit administrative systems at Mexico's oil company. The ransom, reported at about 565 bitcoin, was not paid. The wells, the company said, did not stop.
medellinsoftware.com/story/pemex-ransomware-2019/
Month
Nov 2019
Ransom
~USD 4.9M
Group
DoppelPaymer
Paid
No
On November 10, 2019, Pemex employees arrived to encrypted computers. DoppelPaymer asked for about 565 bitcoin, roughly $4.9 million at the time. The note, as always, mixed a threat and an email address.
The oil company said fuel production and distribution did not stop. What did fall was the administrative layer: mail, files, the office around the well. In a company like that, that layer is also operations.
Mexico did not pay, according to what was reported. The episode stayed as the regional warning before Costa Rica: ransomware was no longer choosing only clinics in Ohio. It was choosing whoever pays the state's payroll.
Conti against Costa Rica arrived three years later and did put a government on its knees. Pemex was the rehearsal in which the crude, at least in the official account, kept flowing.
The desk
The file is public. The briefing is requested.
AI and deep military intelligence. Medellín.