jieh.vn listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: Vietnam
• Announcement date: December 12, 2022

Lockbit3 claims breach of jieh.vn

The Lockbit3 ransomware group has officially listed the Vietnamese organization jieh.vn on its dedicated leak site. According to the announcement made on December 12, 2022, the threat actor group claims that it has targeted the organization and intends to publish its data. The group asserts that an attempted breach of the organization's systems has been occurring since the date the announcement was posted.

Ransomware attacks of this nature often follow a pattern of double extortion. In such scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information. The goal is to pressure the victim into paying a ransom by threatening to release the stolen data on a public leak site, which can cause significant reputational and legal damage. By listing a target on a leak site, the group creates public pressure to force a settlement.

Details regarding the claimed data

At this time, there is no information regarding the specific nature of the data shared or potentially stolen on the leak site. Furthermore, no screenshots of the stolen files have been provided to verify the claims made by the group. The listing currently names no specific data types that have been compromised.

About jieh.vn

JIEH (Joint Stock Company for Industry, Environment and Housing) is a Vietnam-based engineering, construction, and environmental consulting firm. The company operates in the fields of industrial facilities, residential projects, and environmental infrastructure development.

Risk assessment and organizational implications

This incident may pose a risk of the organization's sensitive data being leaked or the entity facing ransom demands. The Lockbit group is known as a ransomware-as-a-service (RaaS) group active since 2019. Although the group's infrastructure was disrupted by international operations in February 2024, it has been reported that they have resumed operations.

The publication of an organization's data can lead to several downstream consequences. For employees and customers, the exposure of personal or corporate information could lead to identity theft or targeted phishing attacks. Such attacks often use the stolen information to craft highly convincing messages designed to trick individuals into revealing further credentials or financial details.

Furthermore, as the organization is based in Vietnam, potential data breaches may trigger legal processes under local data protection regulations. Organizations operating in highly regulated sectors or across international borders must be prepared for the legal complexities that arise following a data breach. To mitigate these risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to help staff recognize phishing attempts.