emotorsdirect.ca listed on LockBit ransomware leak site

• Ransomware group: Lockbit3
• Country: Canada
• Sector: Professional Services
• Announcement date: March 20, 2023

LockBit claims data breach at emotorsdirect.ca

The LockBit ransomware group has listed the Canadian organization emotorsdirect.ca on its dedicated leak platform. According to the group's announcement, the company's data has been compromised. The threat actor has initiated a countdown for the publication of the stolen information, a common tactic used in ransomware operations to pressure victims into meeting specific demands.

In the listing, the group has provided a brief description of the company's business operations alongside samples of documents that they claim were exfiltrated from the organization. These samples serve as a method of proof for the group's claims regarding the successful breach of the target's network.

Data samples and affected information

The information provided in the leak site posting includes screenshots of various documents. These samples indicate that the data allegedly stolen from the organization contains sensitive business and operational information. The specific types of data identified in the samples include:

• Invoices
• Internal statistical reports
• Corporate contact information

While the group has provided these samples to demonstrate the breach, the total volume of data and the specific file count have not been disclosed by the attackers. Additionally, no specific ransom demand has been made public in the current listing.

About emotorsdirect.ca

eMotors Direct is a Canada-based supplier specializing in industrial motors, controls, and gear reducers. The company maintains a wide range of products and provides delivery services to all postal codes across Canada, making them a key player in the regional industrial supply chain.

Risk assessment and organizational implications

This leak claim suggests that the organization's operational data and customer information may be at risk of exposure. For a company operating within Canada, such a breach may trigger legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), which could lead to various regulatory consequences. The potential exposure of this data creates secondary risks for both employees and customers, including the possibility of identity theft or targeted phishing attacks.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been monitored by security researchers since 2019. Despite various international efforts and disruptions aimed at its infrastructure, the group appears to maintain its operations. The publication of an organization's data on such platforms can lead to significant reputational damage and can negatively impact overall supply chain security.

In general, ransomware attacks often employ a 'double extortion' strategy. In this model, attackers do not only encrypt the victim's systems to disrupt operations but also exfiltrate sensitive data before the encryption process begins. The threat of leaking this data on a public site is used as leverage to ensure payment. To defend against such threats, organizations typically focus on robust backup strategies, network segmentation, and continuous monitoring of their environments. Strengthening employee awareness regarding phishing and implementing strict access controls are also fundamental defensive steps that organizations in the industrial and professional services sectors can take to mitigate the risk of unauthorized data exfiltration.