Glsco.com listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: July 19, 2024

The LockBit3 ransomware group has listed glsco.com on its dedicated leak site, alleging that the organization has suffered a data breach. This announcement, published by the threat actor group, suggests a targeted operation against the company's digital infrastructure.

The alleged attack event

According to the announcement published on the LockBit3 leak site on July 19, 2024, the group claims to have successfully gained unauthorized access to the systems of glsco.com. While the listing appeared on the leak site on July 19, the group claims the actual attack occurred on July 18, 2024. This timeline indicates a rapid progression from the initial intrusion to the public listing of the victim on the group's platform.

The presence of an organization on a ransomware leak site typically signifies that the threat actors are attempting to exert pressure on the victim. Ransomware leak sites serve as public bulletin boards where cybercriminal groups post information about their targets to shame them into paying ransoms. These sites often include a countdown timer or a specific landing page for the victim, which serves as a tool for psychological warfare and public exposure.

Details regarding the stolen data

At this stage, the specific details regarding the nature of the alleged stolen data have not been provided by the threat actors. The information currently available on the leak site consists of a general verification page rather than a detailed inventory of compromised files. Consequently, there is no information available regarding the specific types of data, the total volume of data, or the number of files involved in this incident.

Affected data types

• No data types have been named in the current listing.

Organization profile

The target of this alleged attack, glsco.com, is an entity operating within the professional services sector. Great Lakes Supply specializes in the sale and supply of PTAC (Packaged Terminal Air Conditioner) units. The company provides these essential climate control products to a variety of critical industries, including the hospitality, healthcare, education, and multi-family housing sectors. By providing a wide range of PTAC products, the organization plays a role in the supply chain for facilities that require specialized environmental control systems.

Potential impact and industry implications

The implications of this alleged breach are significant due to the sensitive nature of the sectors that glsco.com serves. Because the organization provides services to the healthcare and education industries, any potential exposure of data could lead to widespread consequences. In the United States, where the company is based, such incidents often trigger complex legal landscapes. This includes potential legal proceedings under various state-level data protection laws and the necessity of addressing potential HIPAA compliance requirements, especially if sensitive health-related information is involved.

Based on the established patterns of the LockBit3 group, this incident may follow a double-extortion strategy. In a double-extortion scenario, attackers do not merely encrypt a victim's data to disrupt operations; they also steal sensitive information beforehand. The threat actors then threaten to leak this stolen data on their public site unless a ransom is paid. This method increases the pressure on the organization, as the risk shifts from simple operational downtime to the permanent public exposure of proprietary or personal information.

Furthermore, such breaches can create secondary risks for the organization's clients and partners. If sensitive information is indeed exfiltrated, it can lead to downstream consequences such as identity theft or highly targeted phishing attacks directed at the individuals or institutions served by the company. To mitigate these risks, organizations in the professional services sector often implement defensive measures such as multi-factor authentication, regular security audits, and robust data encryption to protect sensitive information from unauthorized access.