gerb.bg listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: Bulgaria
• Sector: Government & Defense
• Announcement date: August 1, 2023

Lockbit3 claims data breach against gerb.bg

The Bulgarian political entity gerb.bg has been listed on the leak site of the LockBit ransomware group. On August 1, 2023, the LockBit ransomware group posted the organization on its leak site, alleging that a data breach has occurred. Following this announcement, the group initiated a countdown process, stating its intention to publish the institution's data.

LockBit is a well-known cybercrime organization that has been active since 2019. The group is known for utilizing the Ransomware-as-a-Service (RaaS) model to conduct its operations. This model allows different affiliates to use the group's infrastructure to carry out attacks, making it a prolific actor in the ransomware landscape.

Details regarding the alleged breach

While the listing has been made public on the group's platform, the specific details regarding the nature or the scope of the allegedly leaked data have not been provided. There is currently no information available regarding the volume of files or the specific types of data that may have been targeted in this incident.

• No specific data types or file counts have been identified in the listing.

About gerb.bg

GERB is a center-right political party operating in Bulgaria. Founded in 2006, the party has held power in Bulgarian politics for a long time and has formed the government on multiple occasions.

Analysis and potential implications

The claim suggests that the institution's digital assets may have been subjected to unauthorized access. If the data is indeed published, internal communications or sensitive political information could be exposed, which could potentially lead to significant reputational damage for the organization. Given the nature of the entity, such an exposure could have broader political implications.

As an entity operating in Bulgaria, any potential data breach may fall under the scope of the European Union's General Data Protection Regulation (GDPR). This regulatory framework imposes strict requirements on how organizations handle personal data and the responsibilities they hold in the event of a breach. Furthermore, such a breach could increase the risk of targeted phishing attacks or identity theft directed against the institution's stakeholders.

Based on the historical methods employed by the LockBit group, it can be inferred that the group is attempting to exert ransom pressure by threatening to publish data as part of a double-extortion strategy. Double extortion is a common tactic used by modern ransomware groups, where they not only encrypt an organization's data but also steal sensitive information to use as leverage during negotiations. The threat of leaking sensitive information serves as a powerful tool to coerce victims into paying the ransom.

In such scenarios, organizations typically focus on strengthening their defensive posture through various measures. These include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Additionally, maintaining a comprehensive incident response plan is essential for mitigating the impact of a potential breach and ensuring compliance with regulatory requirements like GDPR.