Dalvikurbyggd.is listed on LockBit ransomware leak site

• Ransomware group: Lockbit3
• Country: Iceland
• Sector: Government & Defense
• Announcement date: June 6, 2023

LockBit claims compromise of dalvikurbyggd.is

The LockBit ransomware group has listed the Icelandic local government entity dalvikurbyggd.is on its dedicated leak site. According to the announcement made by the group, the organization has been targeted in a cyberattack, and the group claims to have successfully compromised data belonging to the institution.

The listing was officially posted on the group's leak site on June 6, 2023. Following the announcement, the threat actors initiated a countdown timer, a common tactic used by ransomware groups to pressure victims into meeting ransom demands before the alleged stolen data is released to the public.

Details of the alleged data breach

While the ransomware group has publicly claimed responsibility for the intrusion and the acquisition of sensitive information, specific details regarding the contents of the breach remain unavailable. The listing does not provide information regarding the total size of the data exfiltrated or the specific number of files involved in the incident.

Furthermore, the nature of the data allegedly exfiltrated is not specified in the provided screenshots or the registration details provided by the attackers. The listing names no specific data types.

About dalvikurbyggd.is

Dalvíkurbyggð is a municipality located in the Eyjafjörður region of northern Iceland. It serves as a local government entity that encompasses the settlements of Dalvík, Árskógssandur, and Hauganes.

Analysis and potential impact

This incident suggests that a security breach may have occurred within the institution's digital infrastructure. The potential exposure of public sector data could lead to the disclosure of citizens' personal information and carries risks such as identity theft. Given the GDPR regulations applicable in Iceland, the institution may face legal consequences due to a potential data privacy breach.

Considering the known tactics of the LockBit group, the publication of data may negatively impact the institution's operational reliability. Secondary risks may include the potential use of leaked data in targeted phishing campaigns. Ransomware attacks often employ a "double extortion" method, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations.

In such scenarios, organizations typically face significant pressure to comply with demands to prevent the public release of information. For public sector entities, the stakes are particularly high due to the sensitive nature of the information they manage on behalf of the citizenry. Defensive measures for organizations in this sector often involve robust backup strategies, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration.

General ransomware trends

Ransomware groups like LockBit frequently target government and public sector organizations because these entities often manage vast amounts of sensitive personal and administrative data. The threat of leaking this information creates a high-pressure environment for decision-makers. When a countdown timer is initiated, it is a psychological tactic designed to increase the urgency of the situation, potentially forcing an organization into a hasty response to mitigate the reputational and legal fallout of a public data leak.

• Data exfiltration: The unauthorized transfer of data from a computer or other device.
• Double extortion: A tactic where attackers threaten to leak stolen data if the ransom is not paid.
• Phishing: The use of stolen data to launch more convincing social engineering attacks.