Dragages-ports.fr listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Country: France
• Sector: Transportation
• Announcement date: October 9, 2022

The LockBit3 ransomware group has listed the French organization dragages-ports.fr on its dedicated leak site, alleging that the entity has been the victim of a data breach. This announcement, made on October 9, 2022, marks a new instance of the group targeting specific organizations to pressure them through the threat of data exposure.

The details of the claim

According to the announcement posted on the group's platform, LockBit3 claims to have successfully gained unauthorized access to the systems belonging to dragages-ports.fr. The group asserts that they have obtained data from the organization as a result of this intrusion. While the group has officially listed the domain, they have not disclosed any specific details regarding the ransom demand or the total volume of the data they claim to have exfiltrated.

Ransomware groups like LockBit3 often employ a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information. The threat of leaking this stolen data on a public platform is used as secondary leverage to compel the victim to pay a ransom. Even when no specific ransom amount is mentioned in an initial announcement, the listing itself serves as a public notification of the breach, often intended to damage the victim's reputation and create urgency.

Data and information status

At this time, there is no screenshot or detailed information available regarding the specific content of the leaked data. The listing does not provide any evidence or specific descriptions of the files that the group claims to have stolen. Furthermore, the announcement does not identify any specific data types or categories of information that have been compromised.

About dragages-ports.fr

Dragages-Ports is a public entity based in France that specializes in the dredging and maintenance of ports. The organization plays a critical role in maritime infrastructure by carrying out operations for the deepening, maintenance, and management of ports and waterways.

Impact and security implications

This incident may pose a significant risk to the organization's operational continuity and data privacy. Although the exact content of the leaked data remains unclear, the potential exposure of personal or commercial information could lead to legal sanctions and administrative processes under the General Data Protection Regulation (GDPR). When sensitive information is leaked, it can create a basis for secondary attacks, such as targeted phishing attempts, where attackers use the stolen details to impersonate legitimate entities or gain further access to the network.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. While its infrastructure was disrupted by international operations in February 2024, it has been reported to have resumed its activities. The persistence of such groups highlights the ongoing challenge for organizations in the transportation and infrastructure sectors to defend against evolving cyber threats.

For organizations operating in critical sectors like maritime maintenance and port management, maintaining robust defensive postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited. Monitoring for unauthorized access and ensuring strict data governance can help mitigate the impact of potential breaches and assist in compliance with regulatory frameworks like GDPR.