2plan.com listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Financial Services
• Announcement date: August 9, 2023

Lockbit3 claims data breach against 2plan.com

The Lockbit3 ransomware group has officially listed the United Kingdom-based financial services firm 2plan.com on its dedicated leak site. According to the announcement made on August 9, 2023, the threat actor group claims to have successfully exfiltrated data belonging to the organization. This listing follows a common pattern in modern cyberattacks where ransomware groups utilize double extortion tactics, threatening to publish sensitive information if specific demands are not met.

The group's announcement indicates that the breach occurred on the same day it was posted, August 9, 2023. While the group has claimed responsibility for the intrusion, the specific details regarding the volume of data stolen or the specific ransom amount demanded were not provided in the initial announcement. The listing includes a countdown timer, a psychological tactic used by ransomware operators to pressure victims by indicating a specific timeframe after which the stolen data will be made public to the general population.

Details of the alleged data theft

Based on the information provided by the threat actor, the stolen data is believed to be related to the firm's financial advisory processes. The group has shared screenshots intended to serve as proof of the breach. These sample documents suggest that the compromised information is highly sensitive and directly related to the core business operations of the firm. The content identified in these samples includes various types of client and business information that could be highly valuable on the dark web.

The specific categories of data mentioned in the claim include:

• Financial product details
• Insurance policy information
• Investment account data

The presence of such data in a leak site environment poses significant risks to the individuals and entities involved, as this information can be used for various malicious purposes by other cybercriminals.

About 2plan.com

2plan is a wealth management and financial advisory firm based in the United Kingdom. The company provides administrative, technological, and regulatory support to financial advisers across the country, enabling them to deliver services to their clients. Because the firm operates within the highly regulated financial sector, the integrity and confidentiality of the data they manage are critical to their business model and their clients' trust.

Risk assessment and industry implications

The claim made by Lockbit3 carries significant implications for 2plan.com and its stakeholders. The potential exposure of financial product details, insurance information, and investment account data creates secondary risks, such as identity theft and highly targeted phishing attacks directed at the firm's clients and financial advisers. Furthermore, as an organization operating within the United Kingdom, a confirmed data breach could trigger legal sanctions and intense regulatory scrutiny under the UK GDPR framework.

The severity of this incident is heightened by the nature of the data being managed. Financial data is a primary target for threat actors due to its direct monetization potential. There is also a significant risk that the leaked data could be utilized by other threat actors in the future. The management of such sensitive information means that any breach can lead to long-term reputational damage for the firm.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. It is worth noting that the group's infrastructure was previously disrupted by an international law enforcement operation in February 2024, though reports indicate that the group has since resumed its operations. Organizations in the financial services sector typically mitigate these risks by implementing robust encryption, multi-factor authentication, and continuous monitoring of their networks to detect unauthorized access before data exfiltration can occur.