Kokoklock virus causing long parcel delivery delays

Frustration and anger are mounting – for some small businesses and online shoppers – as delivery giant Toll Holdings struggles to recover from a ransomware attack.

Customers using Toll Holdings are frustrated at delays caused by a ransomware attack on the company. Picture: Carla Gottgens/Bloomberg News

SMALL businesses and online shoppers are venting their anger on social media as a major malware attack on delivery giant Toll Holdings enters its second week.

Japanese-owned Toll, which delivers nationwide, was believed to have been hit by a ransomware demand in January 31.

Ransomware is destructive software which a hacker threatens to use to infect computer systems unless the victim pays a ransom.

$1 for 28 days: Full digital subscription

Parcel delivery delays have spiralled since the attack after the company was forced to shut down many of its computer systems and put on extra staff to manually process delivery orders.

A huge number of businesses and individual online shoppers have been caught up.

“I went to collect my glasses from The Gap (in Brisbane’s inner west) on the weekend and was told it hadn’t turned up and they had a bug backlog because it was all being processed on paper,’’ one customer said on Facebook.

“The shop was very nice but they said the next delivery wasn’t expected until Wednesday (February 12), more than two weeks after I sent the glasses off to be fixed.’’

Another peeved customer wrote online: “I received a notification from Toll saying my bed would be delivered on Jan 28.

“I took work off and was home all day and no bed was delivered.

“I left it a few days as I know things can go wrong but it is now Feb 4.

“I have tried to deal with toll and they can’t tell me anything about a truck that is a week and a half late when it was only coming from Sydney.’’

OTHER TOP STORIES

Uni still going ahead with Orientation Week despite coronavirus

Westside’s healthiest — and most unhealthy — suburbs

Is this a record for the most twins starting Year 7?

Developer clears all but one tree in housing estate

Toll was contacted for comment. It’s latest update, posted on its website on February 6, said it was still “working through the process of resetting back-end IT systems following the recent cyber attack’’.

It also claimed “freight volumes are returning to usual levels’’, partly because of extra staff it had put on to manually process orders.

“Working closely with our external experts and Federal Government authorities, we have made good progress through this past week to gradually reinstate systems securely.

“Over the coming days, and allowing for the inherent complexity of cyber attacks of this nature, our focus is on reinstating foundational IT infrastructure which we actively disabled at the outset.

“From there, we are conducting comprehensive testing of our key systems – including in collaboration with some of our customers – with a view to coming back online securely and as a matter of priority.

Toll Holdings chief executive Michael Byrne speaking at an American Australia chamber of commerce luncheon in 2018. The company is struggling to overcome a malware attack. Picture: Aaron Francis/The Australian

“In the meantime, our business continuity measures are helping to ensure that many of customers can keep accessing our services, and we’re working to support those customers who are experiencing delays or disruption.’’

Toll confirmed on its website that it became aware of the hack on January 31 and immediately began disabling its systems.

It has put on extra call centre staff but its MyToll online booking platform was temporarily disabled.

Customers can instead book deliveries via Priority (13 15 31), IPEC (13 33 66, standard road parcels) or Intermodal and Specialised (13 18 21 (standard bulk freight).

Toll insisted it had no evidence personal data had been lost.

Industry website ITNews reported that Toll was hit with a new variant of ransomware called Mailto or Kokoklock, and that samples were sent to the Federal Government’s Australian Cyber Security Centre.