What the Tietoevry Attack Teaches Us About Surviving Ransomware Attacks

5 Min Read

August 1, 2025

Hacker targeting Tietoevry in a dark cyber attack scene with multiple monitors displaying red and blue code

Introduction 

The word “ransomware” has become synonymous with digital chaos. In today’s world where everything is connected, it’s not a matter of whether your company might face a ransomware attack, but when. 

The cyber threat feels real because it is real. One moment you’re running your business as usual, and the next, your files are locked, your systems are down, and someone is demanding payment to give you back control of your own data. It’s digital extortion, plain and simple. 

One incident that exemplifies the modern threat is the ransomware attack on Tietoevry, a major technology company in Nothern Europe in January 2024. It disrupted operations across Sweden, affecting companies and government entities alike. Their story shows us how dangerous ransomware has become and why no company is truly safe from these digital pirates. 

What Is Ransomware, and What Happens During a Ransomware Attack? 

Ransomware is a type of malware that locks, encrypts, or otherwise blocks access to an organization’s data or systems. Attackers then demand a ransom payment, typically in cryptocurrency, in exchange for a decryption key or promise not to leak stolen data.  

But modern ransomware attacks are even nastier. Criminals don’t just lock your files anymore. They also copy your most sensitive information and threaten to publish it online if you don’t pay. It’s a double threat that makes victims feel trapped with no way out.  

This malicious software has evolved into a lucrative cybercrime business. Some ransomware gangs even operate like corporations—offering “ransomware-as-a-service” and negotiating payment terms. For businesses, the consequences of ransomware attack can include disruption to critical services, regulatory fines for data loss, lost revenue and customer trust, weeks of system downtime, and costly recovery efforts. 

How Ransomware attacks Operate

A ransomware attack typically follows a step-by-step playbook:  

Initial Access: The attacker breaches the network using phishing, brute force, or known exploits.  
Lateral Movement: Malware spreads through internal systems, often undetected.  
Data Encryption: Key files and services are encrypted, rendering them unusable.  
Ransom Demand: A message appears, demanding payment and often threatening to leak stolen data.  
Negotiation or Payment: Victims must decide whether to pay, restore backups, or shut down systems.

Some ransomware attack strains are now capable of double extortion: first encrypting your files, then threatening to release them publicly if the ransom isn’t paid. This raises the stakes dramatically.  

What Happened During the Tietoevry Attack?

In January 2024, Tietoevry, a major Nordic IT services provider, became the latest victim of a sophisticated ransomware attack. 

Headquartered in Finland, Tietoevry provides cloud computing, infrastructure management, and software services to clients in healthcare, banking, manufacturing, and the public sector. Its extensive reach means a successful attack on Tietoevry could have serious knock-on effects across Europe.  

The Attack Breakdown  

Date: Overnight between January 19–20, 2024  
Malware Used: Akira ransomware, known for exploiting VPN flaws
Target: A Swedish data center serving multiple clients     
Detected By: Tietoevry’s internal monitoring systems

While the Tietoevry Attack was confined to a single platform, it affected a wide range of clients across industries. Among the hardest hit were:  

Filmstaden, Sweden’s largest cinema chain  
Rusta, a major retail chain  
Granngården, an agricultural supplier
Government departments and universities

Recovery and Response to the Tietoevry Attack

Tietoevry’s response to this ransomware attack was swift. Cybersecurity teams were mobilized within hours. Over 90% of affected servers were restored from backups within four days. However, due to the complexity of individual client environments, full recovery took several weeks, with services stabilizing by mid-March 2024.  

The company confirmed that no data breach extended beyond the isolated systems. Law enforcement was notified immediately, and customers were kept informed throughout the recovery. 

The Criminals Behind this Ransomware Attack – The Akira Gang 

The group that attacked Tietoevry calls itself “Akira,” named after a famous Japanese movie. Don’t let the pop culture reference fool you – these criminals are serious business. Since March 2023, they’ve attacked over 250 organizations worldwide, stealing an estimated $42 million.  

Akira doesn’t just target one type of business. They go after hospitals, schools, government offices, and tech companies across North America, Europe, and Australia. They’re like digital bank robbers who hit whatever target looks profitable.  

What makes Akira particularly dangerous is their adaptability. They started by attacking Windows computers but quickly learned to target Linux systems too. When companies moved their data to virtual servers thinking they’d be safer, Akira followed them there. It’s like dealing with burglars who learn to pick new types of locks as soon as they’re invented.  

What Went Wrong in the Tietoevry Attack? 

While Tietoevry has not disclosed every detail of the breach, security experts believe the attackers likely exploited weaknesses in VPN configurations. Akira ransomware has a known pattern of targeting such vulnerabilities, especially in third-party IT environments.  

This illustrates a critical issue in modern cybersecurity: remote access and third-party service providers are often the weakest links.  

How to be safe from Ransomware Attacks?  

To defend against ransomware attacks, businesses must adopt a multi-layered cybersecurity strategy that includes prevention, detection, and response.

1. Harden Remote Access Points 

Use multi-factor authentication for all VPN and RDP access  
Regularly update VPN software and firmware 
Monitor remote login attempts for anomalies

2. Keep Systems Patched 

Apply security updates to all systems—OS, applications, and firmware 
Automate patching where feasible
Prioritize Known Exploited Vulnerabilities (KEVs)

3. Backups Are Non-Negotiable  

Follow the 3-2-1 rule: 3 copies of data, on 2 different media, 1 kept offline 
Test backup restoration regularly    
Store backups in segmented or immutable storage

4. Train Employees  

Your team is both your first line of defense and your greatest risk. Regular training helps them:  

Identify phishing emails  
Report suspicious activity quickly  
Avoid risky behavior like password reuse

5. Segment the Network  

Break networks into smaller zones to contain malware  
Limit communication between segments using firewalls  
Use identity-based access control to restrict movement

6. Deploy Advanced Detection  

Use Endpoint Detection and Response (EDR) tools with behavioral analytics  
Leverage SIEM platforms to analyze logs for unusual activity  
Consider Managed Detection and Response (MDR) if in-house capabilities are limited

Lessons from the Tietoevry Attack 

1. Even Experts Are Vulnerable  

Tietoevry had invested over €100 million into cybersecurity infrastructure between 2022 and 2023, yet it still fell victim. No system is 100% secure, which is why resilience and response are as important as prevention.

2. Containment Matters  

The quick isolation of the infected platform prevented further spread. This highlights the importance of: 

Network segmentation  
Automated threat detection  
Clearly defined incident response playbooks

3. Transparent Communication Builds Trust  

Tietoevry was praised for open communication with customers and authorities. In a crisis, clear and honest messaging can preserve business relationships—even if systems are down.  

4. Client Environments Need Extra Care  

As a managed service provider, Tietoevry’s clients expected secure, siloed environments. Moving forward, more companies may demand:  

Dedicated hosting infrastructure  
Client-specific security policies  
Independent security audits

How Businesses Should Prepare Now 

In light of the Tietoevry attack, all businesses—regardless of size—should revisit their cybersecurity posture. Focus areas include: 

Zero Trust Architecture: Assume no user or system is trustworthy by default.  
Cyber Insurance: Review policies to ensure ransomware coverage.  
Tabletop Exercises: Simulate ransomware attacks to train your team.  
Vendor Risk Management: Vet third-party providers carefully and require strong security controls.

If your business depends on third-party IT providers, ensure they have:  

24/7 threat monitoring  
Incident response SLAs  
Data segregation  
Backup and disaster recovery capabilities

Final Thoughts: Don’t Wait for a Crisis 

The Tietoevry ransomware attack was a wake-up call not only for Sweden but for every digital business across the globe. It proved that even companies with deep expertise and significant budgets are not immune to modern cyber threats.

Understanding what ransomware attack is and how to avoid it must become a strategic priority—not just for IT departments but for executive leadership as well. With proactive defense, continuous monitoring, and an organizational culture of security awareness, the damage from ransomware can be reduced—or even prevented.

Prepare now. Because in today’s threat landscape, it’s not a matter of if, but when.

References

This site is registered on wpml.org as a development site. Switch to a production site key to remove this banner.