Gosslaw.com listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: September 3, 2023

The LockBit ransomware group has listed the veteran-focused law firm gosslaw.com on its leak site. This announcement, made on September 3, 2023, indicates a potential data breach involving the organization's sensitive information.

The details of the claim

On September 3, 2023, the LockBit group announced that it would publish data belonging to gosslaw.com on its leak site. The group claims to have compromised all available data from the organization. Within the announcement, a countdown timer for the publication of the data is visible, a common tactic used by ransomware groups to pressure victims into meeting ransom demands.

Ransomware groups often employ a strategy known as double extortion. In this model, attackers do not just encrypt an organization's files to disrupt operations; they also steal sensitive data and threaten to leak it on public forums or dedicated leak sites if the ransom is not paid. This method increases the pressure on the victim, as the threat of public exposure can cause significant reputational and legal damage.

Data involved in the alleged leak

The group has provided screenshots as evidence of the breach. The shared samples in these screenshots include various sensitive documents. The specific types of data identified in the announcement include:

• Legal documents
• Payment information
• Transaction records

While the group claims to have access to all available data, no specific information was provided regarding the total size of the data stolen or the specific number of files involved. Additionally, no ransom demand has been publicly disclosed in the announcement.

About gosslaw.com

Goss Law is a law firm providing legal representation and counsel to U.S. veterans worldwide. Given its focus on veterans, the firm handles sensitive information related to legal matters and personal documentation for a specific demographic.

Impact and risk assessment

The alleged leak may pose a high risk to the organization due to the potential exposure of client confidentiality and sensitive legal data. As a U.S.-based law firm, a potential data breach could lead to legal consequences under HIPAA or state-level data protection regulations. There may be a risk of clients being subjected to identity theft or targeted phishing attacks.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. The group has reportedly continued its operations despite international law enforcement actions against its infrastructure in February 2024. Such groups pose a persistent threat to professional services, where the value of the data held is often very high.

For organizations in the professional services sector, maintaining operational continuity and managing reputation are critical concerns following such incidents. Defensive measures typically include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all systems, and conducting regular security awareness training to prevent initial access through phishing. Furthermore, maintaining comprehensive backups and ensuring they are isolated from the main network can help mitigate the impact of encryption-based attacks.