Frederickco.gov targeted by Lockbit3 ransomware group

• Ransomware group: Lockbit3
• Country: United States
• Sector: Government & Defense
• Announcement date: July 14, 2022

The LockBit3 ransomware group has officially listed the domain frederickco.gov on its dedicated leak site. According to the group's announcement, they claim to have successfully compromised the network of the organization and exfiltrated data belonging to the entity.

The details of the claim

The incident was first announced on the group's leak site on July 14, 2022. The threat actors allege that they gained unauthorized access to the organization's internal network, allowing them to extract information. Since the initial announcement on that date, the group has maintained ongoing threats regarding the potential publication of the institution's data.

Ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption process begins. This allows the group to pressure the victim by threatening to release the stolen data publicly on a leak site if the ransom is not paid. This method increases the leverage held by the attackers, as the threat of a data leak can cause significant reputational and legal damage even if the organization has robust backups to restore its systems.

Information regarding the leaked data

At this time, no details regarding the nature of the leaked or threatened data have been provided by the group. Furthermore, no screenshots have been made available to verify the contents of the alleged breach. The listing does not specify the types of files or the volume of information involved in the claimed exfiltration.

About frederickco.gov

The target of this alleged attack is frederickco.gov, which is a local government entity located in Frederick County, Maryland. This organization serves as a vital administrative hub, providing public services, administrative operations, and various local governance activities to the residents of the county.

Risk assessment and implications

This incident may pose a significant risk of exposing the organization's sensitive data. When data from the public sector is leaked, it can lead to severe consequences for the community, such as the use of citizens' personal information for malicious purposes like identity theft. Because the organization manages public services, the integrity of its data is paramount to maintaining public trust.

Under United States regulations, the organization may be required to fulfill specific data breach notification obligations to inform affected individuals and regulatory bodies. Such requirements are designed to ensure transparency and allow citizens to take steps to protect themselves after a compromise occurs.

The LockBit group is a known ransomware-as-a-service (RaaS) provider that has been tracked since 2019. While their infrastructure was disrupted by an international operation in February 2024, reports indicate that the group has since resumed operations. This persistence makes them a recurring threat in the cyber landscape.

Beyond the immediate impact of the data leak, secondary risks include the potential for the stolen data to be used by other threat actors. Such information is often sold on underground forums or used to fuel highly targeted phishing attacks, where attackers use specific details about an organization or its citizens to increase the success rate of their social engineering attempts.

To defend against such threats, organizations in the government and defense sectors typically focus on implementing multi-factor authentication, maintaining strict network segmentation, and conducting regular security awareness training for staff. Monitoring for unusual data exfiltration patterns is also a critical component of a modern defensive posture.