--- title: Is Data More Valuable Than Jewels? The A-List Cyber Heist That’s Putting Ransomware Attacks On The Map description: Cybercriminals don’t discriminate. It doesn’t matter how famous you are, if your information is vulnerable, then they will exploit it. And that’s exactly what the infamous Russian hacking group, Conti, has managed to do in their latest high-profile ransomware attack on London-based jeweller to the stars, Graff. image: https://csacyber.com/hubfs/data2.png --- [Skip to content](https://csacyber.com/blog/is-data-more-valuable-than-jewels-the-a-list-cyber-heist-thats-putting-ransomware-attacks-on-the-map#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search October 10, 2021 4 min read time # Is Data More Valuable Than Jewels? The A-List Cyber Heist That’s Putting Ransomware Attacks On The Map ![Cyber Security Associates](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Cyber Security Associates -](https://csacyber.com/blog/author/cyber-security-associates) [Article](https://csacyber.com/blog/tag/article) ![](https://csacyber.com/hubfs/data2.png) ### Executive Summary Cybercriminals don’t discriminate. It doesn’t matter how famous you are, if your information is vulnerable, then they will exploit it. And that’s exactly what the infamous Russian hacking group, Conti, has managed to do in their latest high-profile ransomware attack on London-based jeweller to the stars, Graff. Wealthy, powerful and famous people such as David Beckham, Donald Trump and Oprah Winfrey are among Graff’s regular customers. Safe to say, they would not have expected their private data and information to be at risk following their purchases! With client lists, invoices, receipts, credit notes and details like home address all at stake, public exposure could prove to be reputationally damaging and embarrassing for Graff’s celebrity clientele. The data could reveal evidence of gifts bought for secret lovers or jewellery accepted as bribes. The hacking group is demanding tens of millions of pounds in ransom and has already published 1% of the data they are holding on the dark web. That equates to a whopping 69,000 records belonging to 11,000 of the diamond specialist’s A-list customers. Once on the dark web, the data could be used for further theft, extortion or blackmail by the terrorists and criminals that frequent it. Unfortunately for these celebrity victims, the consequences of the hack could potentially continue long after the initial ransomware attack is resolved. ### How Did The Attack Happen? For a Ransomware-as-a-Service attack to work, hackers first need to gain access to a target’s IT infrastructure and database in order to infect it with a virus. Typically, this requires a ‘back door’ entry that allows the hackers to avoid detection and bypass any anti-virus software or firewall that could prevent them from stealing the company’s data. Whilst an investigation from the Information Commissioner’s Office (ICO) is ongoing, we suspect that one of Graff’s staff fell victim to a phishing email scam and unknowingly opened a file containing the sophisticated ransomware computer virus. Unfortunately, once that ransomware software was detected in the system, it was too late. With its reputation and that of its wealthy customers on the line, Graff needed to react quickly. It managed to shut down its network as soon as the intrusive activity was detected by its security systems. According to a Graff spokesperson, they have been working closely with the ICO and relevant law enforcement agencies to solve the issue and have already informed the individuals whose personal data was affected and have advised them on the appropriate steps to take. ### Who Are Conti? Believed to be based near St Petersburg, malicious activity from the Russian hacking group, Conti was first spotted in May 2020 and claims to personally have had over 150 successful extortion attacks in that year alone, making up to $20 million in revenue. Conti distributes a modified version of the 'Ryuk' ransomware which is used by affiliates of the 'Wizard Spider' group, offering ransomware as a service (RaaS). The human-operated double extortion ransomware gets in there quickly to steal and threaten to expose data, as well as encrypt it before most organisations have even noticed. Known for how fast it can deploy and encrypt data systems, Conti has been flagged by the CISA, the FBI and the NSA in a joint Cyber Security Advisory to warn organisations of the increased ransomware attacks. ### Why Are Ransomware Attacks On The Rise? In the first half of 2021, the number of ransomware incidents doubled globally. Attacks involving data exfiltration and the leakage of victims’ data spanned 63 countries and 18 industries, with manufacturing being the most affected. Cybercriminals are opportunistic. It’s clear that hackers are wising up to the potential profitability of ransomware attacks since they remain largely uncontested and highly profitable. In other words, malicious actors continue to make good money from these types of incidents. The Graff attack is a prime example of how much value is placed on private data with huge ramifications for the privacy of the impacted clients. Due to the high-profile nature of the clients, including infamous figures such as Ghislaine Maxwell, and the Saudi Crown Prince Mohammed bin Salman, the data is worth an incredible amount to other malicious groups. Currently, ransomware is one of the biggest threats any organisation can face. The deployment speed, level of destruction, lasting reputational damage and extortionate costs it takes to recover, render ransomware one of the most immediate dangers faced by the UK and beyond. ### Our Solution? When discussing how to tackle an attack from a sophisticated hacking group like Conti, the first step, of course, is to prevent it from happening in the first place. User awareness and practising good cyber hygiene is key to ensuring an attacker cannot gain a foothold on a victim network. As mentioned earlier, the malware in the Graff attack was likely deployed via a malicious email attachment and lack of staff awareness. Education and training, like what we offer here at CSA, is invaluable for detecting and preventing attacks such as these. The best way for an organisation to prove their defences can protect them if ransomware, like in the Graff case, was deployed onto their IT systems and infrastructure is to put it to the test. And, we offer several services, such as a Simulated Phishing Campaign and Ransomware Attack Simulation to do just that! Undertaken by our team of expert cyber professionals, our services test your IT defences and incident response capabilities by issuing a real-time, ‘benign’ ransomware attack or simulated phishing campaign. Deployed safely and under the visibility of your own team, our simulations will mimic an attack on your IT services and demonstrate what would happen to your IT systems if a real-life incident took place. Following the simulation service, we will be able to assess where any vulnerabilities lie, should there be any, and make recommendations on corrective actions and solutions to help strengthen your IT defences for the future. To find out more about our Simulated Phishing Campaign and Ransomware Attack Simulation Service and how we can help your business stay secure, get in touch! Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images%20%281%29.jpg?width=624&height=427&name=Blog%20images%20%281%29.jpg)](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) October 19, 2026 5 min read ### [When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) The recent cyber incidents involving two Texas-bound energy tankers may be one of the clearest... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images.jpg?width=624&height=427&name=Blog%20images.jpg)](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) October 16, 2026 14 min read ### [The attack surface has changed. The fundamentals have not.](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) Note from the author: Fair warning: this turned into a longer post than planned. I’m under no... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Cyber Security Associates", "url" : "https://csacyber.com/blog/author/cyber-security-associates" }, "dateModified" : "2024-12-06T16:04:16.975Z", "datePublished" : "2021-10-10T04:00:00.000Z", "headline" : "Is Data More Valuable Than Jewels? The A-List Cyber Heist That’s Putting Ransomware Attacks On The Map", "image" : [ "https://csacyber.com/hubfs/data2.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/is-data-more-valuable-than-jewels-the-a-list-cyber-heist-thats-putting-ransomware-attacks-on-the-map", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```