ak.com.sa listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Country: Saudi Arabia
• Sector: Retail & E-Commerce
• Announcement date: January 16, 2023

The retail company ak.com.sa has reportedly been listed on the LockBit leak site. The ransomware group LockBit3 has claimed to have compromised the institution's data, according to an announcement made on their platform.

The claimed attack and event details

On January 16, 2023, the LockBit group listed ak.com.sa on their dedicated leak site. This announcement coincided with the date the group claimed the attack took place. While the group has publicly asserted that they have successfully compromised the institution's data, they have not provided any supporting evidence to substantiate these claims.

In many ransomware incidents involving double extortion, threat actors attempt to pressure victims by threatening to release sensitive information. This tactic is designed to maximize leverage during ransom negotiations. However, in this specific instance, the group has not provided any screenshots or file samples regarding the content of the announcement. This lack of evidence makes it impossible to verify the current status of the data or the specific nature of the intrusion at the time of the posting.

Information regarding the leaked data

Regarding the content of the leak, there is no information available concerning the nature of the leaked or threatened data. The group has not provided any screenshots to demonstrate the contents of the alleged breach. Consequently, the listing names no specific data types.

About the organization

M.A. Al Abdul Karim & Co. is a leading retail company operating in the Middle East. The organization offers products from globally renowned brands and operates with a business model that is focused on high retail standards and customer service.

Analysis and potential implications

The LockBit group is a known ransomware actor that has been active since 2019. It is worth noting that the group's infrastructure was disrupted by international operations in February 2024. Given the known tactics of this group, the possibility that the data may be published or sold should be considered.

The leakage of an institution's data can result in significant secondary risks. For customers and employees, this may include the threat of identity theft or the occurrence of targeted phishing attacks. Furthermore, the institution may face legal obligations under Saudi Arabian data protection regulations following such an event.

For organizations operating within the retail and e-commerce sectors, such incidents can lead to negative impacts on operational continuity and reputation management. To mitigate these risks, organizations typically focus on robust defensive measures. These include maintaining rigorous patch management, implementing multi-factor authentication, and conducting regular security awareness training for employees to prevent initial access. Additionally, maintaining comprehensive backups and ensuring data encryption can help protect sensitive information from being exploited even if a breach occurs.