fawry.com listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: Egypt
• Sector: Financial Services
• Announcement date: November 8, 2023

Lockbit3 claims breach of fawry.com

The Lockbit3 ransomware group has listed fawry.com on its dedicated leak site following allegations of a data breach. The group claims to have successfully compromised the digital financial systems of the organization. According to the announcement made on November 8, 2023, a countdown timer has been initiated on the group's website, indicating that the publication of the stolen data is pending.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion, where they not only encrypt an organization's internal data but also steal sensitive information. If the ransom is not met, the group threatens to publish the stolen data publicly to cause reputational and regulatory damage. This method significantly increases the pressure on the victim organization to comply with the attackers' demands.

Data types involved in the alleged breach

The listing includes a sample table that allegedly contains personal user data. Based on the information provided by the group, the exposed information includes various sensitive details that could be used for malicious purposes. The data types identified in the leak include:

• Personal identification information
• Contact information
• Address information

Specifically, the provided screenshot displays a sample containing names, surnames, dates of birth, national identification numbers, addresses, phone numbers, and marital status. The exposure of such highly specific personal details increases the potential for misuse by third parties.

The organization profile

Fawry is a leading provider of e-payments and digital finance solutions based in Egypt. The company offers accessible and reliable financial services to millions of banked and unbanked users, playing a significant role in the region's digital economy.

Implications and security considerations

This alleged breach may increase the risk of identity theft and fraud for users of the financial services provider. The nature of the exposed data could trigger regulatory and legal scrutiny under relevant data protection laws. Furthermore, the publication of this data may lead to secondary phishing attacks, where attackers use the stolen contact information to target individuals with deceptive communications.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. Although its infrastructure was disrupted in February 2024, it has been reported to have resumed operations. The vulnerabilities within an institution's systems that allow such an attack can also pose risks to broader supply chain security, as interconnected digital ecosystems mean a breach in one provider can impact many users.

For organizations operating in the financial services sector, maintaining robust defensive postures is critical. This typically involves implementing multi-factor authentication, conducting regular vulnerability assessments, and ensuring rigorous encryption for data at rest and in transit. Organizations must also prepare incident response plans to address the legal and regulatory consequences that follow data exposure. Monitoring for signs of unauthorized access and implementing strict access controls are standard industry practices to mitigate the risk of such compromises.