Toll Group extends ransomware recovery into next week

Toll Group will use next week to progressively restore its customer-facing applications like MyToll after managing to recover one of the core IT systems underpinning its online operations.

Photo credit: Toll Group.

The company said late yesterday it had managed “the full and secure reactivation of one of our core IT systems” after it was infected with ransomware called Nefilim at the start of the week.

“With that in place, our focus is on bringing our customer-facing applications online as a matter of priority,” it said in an advisory.

“At this stage, we expect these applications will be progressively restored and tested throughout next week. 

“As such, we are planning for business continuity and manual processes to continue into next week to keep services moving as we work towards the full and secure reactivation of our online systems.”

Earlier guidance had pointed to business continuity and manual processes being in place “through the week”, leading to speculation of a speedy recovery.

The company’s last encounter with ransomware - albeit a different type - took six weeks to recover from.

It will now use the remainder of this week to scan and test its server fleet, “which we will gradually and securely bring back online.”

In addition, it said, external email has now been restored.

Email access for Toll employees “who operate on our cloud-based platforms is being progressively restored.” 

“Work is continuing on restoring remaining email servers,” it said.

The company said MyToll customers could book parcel pick-ups “by calling our contact centres, with contact details available via the MyToll website.”