X

FBI reportedly withheld ransomware key from business for 3 weeks in failed sting

The delay is estimated to have cost companies millions of dollars.

Rae Hodge Former senior editor
Rae Hodge was a senior editor at CNET. She led CNET's coverage of privacy and cybersecurity tools from July 2019 to January 2023. As a data-driven investigative journalist on the software and services team, she reviewed VPNs, password managers, antivirus software, anti-surveillance methods and ethics in tech. Prior to joining CNET in 2019, Rae spent nearly a decade covering politics and protests for the AP, NPR, the BBC and other local and international outlets.
See full bio
Rae Hodge
FBI sign
Mandel Ngan/AFP/Getty Images

The FBI had digital keys that would have unlocked ransomware-attacked business data, according to a Tuesday report from The Washington Post, but withheld those keys for three weeks in a failed bid to target the hackers. The agency got the encryption keys after gaining access to the servers of the Russia-based criminal gang REvil following the group's June attack on meat-processing company JBS.  

The group then attacked Miami-based IT firm Kaseya, which said 54 of its clients were directly infected but also estimated the attacks infected between 800 and 1,500 businesses using Kaseya software. Many of the businesses were forced to resolve the issue at significant cost. The FBI reportedly gave Kaseya the decryption key on July 21, but a Kaseya spokesperson told the Post that the company didn't know how many of its 54 clients were able to use the key. 

Read more: Ransomware attack on Kaseya, a software firm, threatens businesses worldwide

On Thursday, Romanian cybersecurity firm Bitdefender released a decryption key it says can unlock computers affected by any of the REvil ransomware encryption deployed before July 13, though not those affected by later versions of the malware. It hasn't yet named the law enforcement agency it collaborated with to obtain and release the key. 

As noted by the outlet, since REvil's reappearance this month, eight new victims have been struck by the group's attacks, including a legal aid service for the poor.

The FBI declined CNET's request for comment.