LockBit claims ransomware attack behind Essendant's multi-week outage

Essendant, an Illinois-based wholesale distributor of office products owned by Staples, went offline on the evening of Monday, March 6, 2023 in an outage that lasted well over a week and disrupted both customers and suppliers.

The company initially described the disruption only as a network outage. Customers could not place or fulfil online orders and could not reach customer care, and freight carriers were told to halt all pickups until further notice. Essendant later published a security incident update confirming that forensic investigators had determined the outage was caused by ransomware.

The LockBit ransomware operation added Essendant to its dark web leak site on March 14, 2023, taunting the company over its recovery efforts. LockBit published the files it claimed to have stolen on March 18, which usually indicates that a victim declined to pay. CyberInsider reported that the leaked set included financial reports, documents containing employee personal information and reseller contracts. Essendant did not confirm whether customer data was involved.

By March 20 the distributor's pick, pack and ship systems were running again, but customer phone lines remained down, email responses were delayed, and services including credit card processing and special orders were still offline. No ransom amount was disclosed.