Criminals unleashed a massive ransomware attack in more than a dozen countries on Friday, affecting up to 1,500 organizations around the world, including a supermarket chain in Sweden and schools in New Zealand.

Security researchers linked the attack to a group called REvil, a Russian-speaking gang responsible for a ransomware attack on meat processor JBS at the end of May.

In the current incident, the attackers found a vulnerability in the product of Kaseya, a U.S.-headquartered company that provides software tools to its clients — IT outsourcing companies — which in turn provide services to their clients. Kaseya estimates that as many as 1,500 “downstream” businesses were affected.

Hackers have demanded $70 million in cryptocurrency in exchange for a key that decrypts all of the victims’ data.