Heras.co.uk listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: May 29, 2024

Lockbit3 claims data breach against heras.co.uk

The Lockbit3 ransomware group has officially listed the United Kingdom-based organization heras.co.uk on its dedicated leak site. According to an announcement posted on May 29, 2024, the threat actors claim to have successfully compromised data belonging to the organization. This development follows the group's established pattern of targeting various entities to exert pressure through data exposure.

The claim, announced on May 29, 2024, suggests that the attackers have gained access to a variety of sensitive files. The threat actors have indicated their intention to release these files, which reportedly include critical financial information and sensitive customer data. Lockbit3 is a known ransomware operation that has been active in the cyber threat landscape since 2019, utilizing sophisticated methods to target organizations across various sectors.

Details of the alleged data theft

The post published by the ransomware group outlines a significant scope of data that has supposedly been exfiltrated from the organization's systems. The group claims that the leaked information includes a wide array of private and sensitive documents that could impact both the company's internal operations and its external relationships. The specific types of data mentioned in the claim include:

• Financial data
• Customer building schemes
• Non-disclosure agreements (NDA)
• GDPR-related data
• Salary data
• External audit reports

The inclusion of such diverse data types suggests a broad compromise of the organization's digital environment. While the specific volume of the data or the exact file count has not been disclosed by the group, the nature of the listed items points toward a deep penetration into the organization's administrative and operational files.

Organization profile

The target of this alleged attack, heras.co.uk, is an organization operating within the United Kingdom. It is categorized within the professional services sector and is recognized as a European-based provider of perimeter protection solutions.

Potential risks and security implications

The alleged leak of this information carries several significant risks for the organization and its stakeholders. One of the primary concerns is the potential for secondary attacks. The exposure of sensitive information can be used by threat actors to facilitate identity theft or to launch highly targeted phishing campaigns against the organization's employees and its customer base. When attackers possess specific details about an organization's internal workings, they can craft much more convincing social engineering attacks.

Furthermore, the presence of data subject to the General Data Protection Regulation (GDPR) in the alleged leak may lead to serious legal and regulatory consequences for the organization, particularly given its operations within the United Kingdom. The exposure of such data often triggers mandatory reporting requirements and potential investigations by data protection authorities. Additionally, the claim that trade secrets and customer building schemes have been compromised introduces long-term security vulnerabilities regarding supply chain integrity. If customer designs or schemes are exposed, it could undermine the trust and security of the entire supply chain involving the organization.

The use of a double extortion strategy—whereby attackers not only encrypt data but also threaten to leak it—is a hallmark of the Lockbit group's historical methods. This approach is specifically designed to maximize the pressure on an organization to meet ransom demands. To mitigate such risks, organizations in the professional services and infrastructure sectors typically focus on robust defensive measures. These include implementing strict access controls, enhancing monitoring and detection capabilities, maintaining offline backups, and conducting regular security awareness training to defend against the social engineering tactics that often follow a data breach.