MSI confirms security breach following ransomware attack claims


Following reports of a ransomware attack, Taiwanese PC vendor MSI (short for Micro-Star International) confirmed today that its network was breached in a cyberattack.

Earlier this week, the Money Message ransomware gang claimed to infiltrate some of MSI’s systems and stolen files that will be leaked online next week if the company refuses to pay a $4 million ransom.

In a Friday filing with Taiwan’s Stock Exchange (TWSE), first spotted by PCMag, MSI revealed that some of its information service systems had been affected by a cyberattack reported to the relevant authorities.

“After detecting some information systems being attacked by hackers, MSI’s IT department has initiated information security defense mechanism and recovery procedures. The Company also has been reported [sic] the anomaly to the relevant government authorities,” MSI said.

The company did not share any details on the timing of the attack, about if any of the affected systems were encrypted, or if the attackers exfiltrated business and customer information during the incident.

However, MSI did say that the cyberattack has had no “significant” operational and financial impact, with security enhancements implemented to ensure that data stored on affected systems is secure.

“No significant impact our business in terms of financial and operational currently. The Company is also enhancing the information security control measures of its network and infrastructure to ensure data security.”

MSI also published a statement on Friday warning customers to ensure that they get their BIOS and firmware updates from official sources.

“MSI urges users to obtain firmware/BIOS updates only from its official website, and not to use files from sources other than the official website,” the company said.

MSI TWSE filing regarding cyberattackMSI TWSE filing regarding cyberattack (BleepingComputer)

​BleepingComputer first covered the Money Message ransomware operation’s activity in a report published last weekend after hearing of the group’s potential involvement in the breach of a high-profile computer hardware vendor.

According to chats seen by BleepingComputer between the ransomware gang and an MSI representative, the threat actors demanded a ransom payment of $4,000,000 based on a claim that they’ve stolen roughly 1.5TB worth of documents from MSI’s network.

Money Message now threatens to release the allegedly stolen files sometime next week if MSI fails to meet its ransom demands.

The threat actors have listed MSI on their data leak site, so far only sharing screenshots of what they describe as the PC maker’s Enterprise Resource Planning (ERP) databases and files containing software source code, private keys, and BIOS firmware.

MSI is yet to reply to multiple emails from BleepingComputer asking for a statement regarding the Money Message ransomware gang’s claims.

Update April 07, 17:23 EDT: Added MSI statement.


  • h_b_s Photo h_b_s – 2 days ago

    So not only did they lose the keys to their own castle, and part of their treasury, they also in effect lost the keys to their customer’s castles as well in the form of what’s needed to create and drop hostile firmware for system boards. MSI’s incompetence knows no bounds.

    They don’t even mention whether or not any of the recent firmware update files on their own damned website might be compromised because we aren’t told the dates or extent of penetration. It’s likely even MSI doesn’t really know if they’re as bad as some companies have been in (not) keeping proper logs.

  • K42 Photo K42 – 1 day ago

    There is nothing in the articles about code being hacked on MSI code archives or on their download server.

    Other recent code leaks did not include real private keys, only test keys. Hopefully the BIOS engineers don’t handle the necessary private keys for production machines. Even 30 years ago when I was responsible for creating private keys for production machines, I used a separate air-gapped machine that was kept in a safe when I was creating the keys. Of course, BIOS and Windows was much simpler then.

  • Malwarebytes Anti-Malware Logo

    Malwarebytes Anti-Malware

    Version: 4.5.26 4M+ Downloads

  • AdwCleaner Logo


    Version: 56M+ Downloads

  • Windows Repair (All In One) Logo

    Windows Repair (All In One)

    Version: 4.13.1 2M+ Downloads

  • Everything Desktop Search Logo

    Everything Desktop Search

    Version: 22,631 Downloads

  • Zemana AntiLogger Free Logo

    Zemana AntiLogger Free

    Version: 53,506 Downloads


Related posts

Whoosh confirms data breach after hackers sell 7.2M user records

Sarah Henriquez

GitLab ‘strongly recommends’ patching max severity flaw ASAP

Sarah Henriquez

Previously unidentified ARCrypter ransomware expands worldwide

Sarah Henriquez

Leave a Comment