In addition to Russian entities, Anonymous says it is now targeting certain Western companies.
Jakub Porzycki | Nurphoto | Nurphoto | Getty Images
The “hacktivist” collective known as Anonymous has said it has a new target in its “cyber war” against Russia: Western companies still doing business there.
A publication on March 21 from a Twitter account named @YourAnonTV said: “We call on all companies that continue to operate in Russia by paying taxes to the budget of the criminal Kremlin regime: get out of Russia!
The tweet, which has been liked more than 23,000 times, gave companies 48 hours to comply.
The threat, which was later echoed on other Twitter accounts affiliated with Anonymousincluded a photo with the logos of some 40 companies, including household names such as Burger King, Subway and General Mills.
Later, the account tagged more companies on the post, ostensibly warning them that they too could soon be targeted.
CNBC has reached out to the companies mentioned in this story for comment. Most of the responses reflected press releases issued by the companies, which are linked throughout this story, that followed the posts.
Tire company Bridgestone and Dunkin’ said that at the time they were targeted by Anonymous, they had already announced publicly that they were pulling business out of Russia.
Both companies also responded directly to Anonymous on Twitter. Bridgestone’s response related to a press release, and Dunkin’ linked to media coverage of his decision, both of which predated the publication of Anonymous.
Twitter users also pointed out that other companies, such as Citrix, had already announced similar measures. A blog post on Citrix’s website states, “Unfortunately, we see many incorrect reports in social and traditional media regarding Citrix’s operations in Russia.”
Three targeted oil service companies – Halliburton, Baker Hughes and Schlumberger – had also previously issued announcements regarding their business activities in Russia. These statements followed a Washington Post article imploring readers to stop investing in companies deemed to be “funding Putin’s war”.
Intentional or ‘fog of war?’
Cyberattacks during the “fog of war” are dangerous, said Marianne Bailey, cybersecurity partner at consultancy firm Guidehouse and former head of cybersecurity at the U.S. National Security Agency.
“A retaliatory cyberattack…could be directed at the wrong place,” she said.
However, it’s also possible that Anonymous was unimpressed with some of these companies’ promises. Some companies – including Halliburton, Baker Hughes and Schlumberger – have not performed well on a list of companies compiled by the Yale School of Management. The list ranks some 500 companies by whether they have halted or continued operations in Russia, giving them school-like grades.
Notably, Bridgestone’s decision received an “A” and Dunkin’ a “B” on Yale’s list.
Many companies that received “F”s on Yale’s list have appeared on a second anonymous Twitter post published on March 24. The post targeted a new – and apparently updated – list of companies, which included airline Emirates, French gardening retailer Leroy Merlin and essential oil company Young Living.
Several companies caught in the crosshairs of Anonymous quickly announced they were cutting ties with Russia, including Canadian oil services company Calfrac Well Services and sanitary ware maker Geberit Group – the latter including hashtags for Anonymous and Yale in his Twitter announcement.
French sporting goods company Decathlon announced this week that it was also closing stores in Russia. But Anonymous had already claimed the closure of its Russian website, as well as the sites of Leroy Merlin and the French supermarket company Auchan.
Jeremiah Fowler, co-founder of cybersecurity firm Security Discovery, said his research determined that Anonymous had also successfully hacked into a database belonging to Leroy Merlin.
“I am absolutely sure [Anonymous] found it,” he said, saying the collective left messages and references inside the data.
Anonymous also claimed last week that he hacked into a database of another targeted company, the Swiss food and beverage company Nestlé. However, Nestlé told CNBC that these claims have “no basis.” Design and technology website Gizmodo reported that Nestlé said it accidentally leaked its own information in February.
Nestlé has since announced it is reducing its operations in Russia, but the measures have been dismissed as insufficient by at least one anonymous online account.
Other forces at play
It is unclear whether Anonymous’ threats influenced the companies’ decisions to cease operations in Russia.
Indeed, other forces were also at play, including online calls to boycott some of the companies targeted in recent weeks.
Activists stage a protest against Koch Industries on June 5, 2014 in New York City. The American conglomerate was one of the few companies targeted by the two posts from the @YourAnonTV Twitter account. The company also received an “F” on Yale’s list for not removing its business activities from Russia.
Spencer Platt | Getty Images News | Getty Images
After being targeted by Anonymous, the French car manufacturer Renault has announced that it is suspending operations at a Moscow plant. However, Ukrainian President Volodymyr Zelenskyy has publicly singled out Renault, as well as Nestlé, during televised speeches to European governments and citizens.
A Renault spokesperson told CNBC that its decision had nothing to do with Anonymous.
Other companies have made moral arguments for continuing to operate in Russia. Auchan, in a press release issued this week, said the Russians had “no personal responsibility for starting this war. Abandoning our employees, their families and our customers is not the choice we made.” .
Unlike McDonalds, which owns about 84% of its outlets in Russia, companies such as Burger King, Subway and Papa John’s often operate there through franchise agreements. Burger King said it asked the main operator of its franchises to suspend restaurant operations in Russia, but “they refused”.
Alexander Saiganov | SOPS | Light flare | Getty Images
Force majeure clauses – which allow parties to terminate a contract in circumstances such as natural disasters or acts of terrorism – do not apply here, Antel said. The same goes for clauses covering sanctions, which, when present, generally only apply if the parties to the contract are sanctioned, not the country where they are located, he said.
Antel said franchisors likely have no legal right to close franchises in Russia. But he said he expects franchisors to do so anyway for a variety of reasons: moral decisions, to mitigate reputational damage and to avoid the cost of complying with sanctions, especially since Russia “doesn’t represent a big percentage of sales” for most of these companies. .
“Concerns about hackers and data protection … could also be a good reason,” he said.
He suspects franchisors will broker deals to “share the pain,” either by agreeing to temporarily halt operations or through settlement fees to end the relationship, he said.
He said he brokered a deal – out of hundreds – in which a hotel owner in Russia wanted the contractual right to walk away if an international incident made it detrimental to his wider business interests.
“God, we had to fight for this,” Antel said.
However, he said he now expects contract release options to be much more common in the future.