The Netflim ransomware operators leaked the first installment of data from a massive 200 GB worth of data of the global logistics company Toll Group. The operators hacked the Toll network via its ransomware at the beginning of this month and breached a massive volume of data before encrypting the Toll network. The ransomware operators leaked the data consolidated in compressed files along with a note.

Australian transportation and logistics company Toll Group's systems across multiple sites and business units were encrypted and affected by a ransomware called the Mailto ransomware. Between 1 and 16 NetWalker ransom notes and/or sample encrypted files have been submitted per day for analysis for 30 days. Service was disrupted and systems were shut down.

In January 2020, Toll Group, a Melbourne-based logistics company, fell victim to a ransomware attack orchestrated by the hacker group Nefilim. The attackers deployed Mailto ransomware, encrypting and exfiltrating 220 GB of data from a corporate server. The compromised data included sensitive information about current and former employees, such as personal and employment records. The primary motive was financial extortion, with hackers demanding a ransom in exchange for decryption keys and to prevent public exposure of the stolen data. Toll Group refused to negotiate or pay the ransom, opting instead to restore systems from backups and implement enhanced cybersecurity measures. The incident disrupted internal operations, raised concerns over employee data privacy, and highlighted vulnerabilities in the company’s IT infrastructure. While no customer data was reported as breached, the attack underscored the growing threat of targeted ransomware campaigns against large enterprises, particularly in the logistics and supply chain sectors.