Goldenc.com listed on LockBit3 ransomware leak site

• Ransomware group: LockBit3
• Country: United Kingdom
• Sector: Retail & E-Commerce
• Announcement date: December 22, 2023

LockBit3 claims data breach at goldenc.com

The LockBit3 ransomware group has officially listed the domain goldenc.com on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully obtained sensitive data belonging to the organization. This listing serves as a public notification from the group, which has threatened to release the acquired information to the public if their demands are not met.

The incident was announced on December 22, 2023, with the group claiming the attack occurred on the same day. The entry remains active on the group's data leak platform, where it is currently listed as a data leak. While the group has published this announcement, no specific information has been provided regarding the total size of the data stolen, the specific number of files involved, or the specific ransom demand being made by the attackers.

Details of the claimed data theft

Based on the information provided by the threat actors, the breach involves a significant amount of personal and professional information related to the company's workforce. The data exposed in the leak includes various identifiers that could be used for malicious purposes. Specifically, the information reportedly includes names, surnames, job titles, and company information. Furthermore, the leak is said to contain locations, personal and business email addresses, and mobile phone numbers.

In addition to direct contact details, the group claims to have access to social media profiles belonging to employees, specifically mentioning platforms such as LinkedIn, Twitter, and Facebook. The following types of information are identified as being affected by this claimed breach:

• Employee contact information
• Employee personal data
• Corporate personnel records

About the target organization

The target of this alleged attack is goldenc.com, a prominent entity in the United Kingdom's retail and e-commerce sector. Golden Coast is recognized as one of the UK's leading independent distributors of wet leisure products, specializing in equipment for pools and spas. The organization has been part of the Pollet Pool Group since 2022.

Risk assessment and implications

The exposure of this data presents several significant risks to the affected individuals and the organization itself. For the employees whose personal information has been compromised, there is a heightened risk of secondary attacks. These include identity theft and highly targeted phishing campaigns, where attackers use the stolen professional and personal details to craft convincing social engineering messages.

From a regulatory perspective, because the organization is based in the United Kingdom, the exposure of employee data may fall under the scope of the UK General Data Protection Regulation (UK GDPR). This could potentially trigger various regulatory consequences for the company. Additionally, the leak poses risks to the organization regarding its operational continuity and its overall reputation.

LockBit is a known ransomware-as-a-service (RaaS) group that has been active since 2019. Despite various international operations aimed at disrupting their infrastructure, the group has demonstrated a persistent tendency to resume its operations. This pattern highlights the ongoing threat posed by RaaS models, where developers lease ransomware to affiliates to carry out attacks.

In general, when organizations face such threats, common defensive steps include implementing robust multi-factor authentication, maintaining rigorous backup protocols, and conducting regular employee security awareness training to mitigate the risk of phishing. For companies in the retail and e-commerce sectors, protecting customer and employee data is a critical component of maintaining operational integrity and consumer trust.