LockBit 3.0 ransomware group lists rajawali.com on its leak site

• Ransomware group: LockBit 3.0
• Country: Indonesia
• Sector: Hospitality
• Announcement date: February 13, 2024

LockBit 3.0 claims data breach at Rajawali Group

The LockBit 3.0 ransomware group has listed the Indonesian investment holding company Rajawali Group on its dedicated leak site. According to an announcement made on February 13, 2024, the threat actors claim to have successfully executed an attack against the organization, resulting in the theft of a significant volume of sensitive corporate and personal information.

The claim of the attack coincides with the date the listing appeared on the leak site. This type of activity is characteristic of ransomware groups that utilize double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data to use as leverage. By threatening to publish this information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of confidential records.

Details of the alleged data theft

The threat actors behind the LockBit 3.0 group claim to have obtained a wide array of internal documents belonging to rajawali.com. The announcement specifies that the stolen information includes critical financial records and audit reports, which are vital to the company's operational integrity. Furthermore, the group asserts that they have accessed personnel information and various client data sets.

The breach is described as extensive, with the attackers specifically highlighting that the compromised data includes over 1,000 copies of passports. Evidence provided via screenshots allegedly shows samples of the stolen material, confirming the presence of highly sensitive documents. The specific types of data mentioned in the listing include:

• Passport copies
• Financial records
• Audit reports
• Personnel data
• Client information
• Identification cards

While the attackers have provided samples of these files, such as financial statements, accounting files, audit documents, and personnel identification cards, no specific information was provided regarding the total size of the data stolen or the specific amount of a ransom demand.

About Rajawali Group

Rajawali Group is an investment holding company based in Indonesia. The organization maintains a diverse portfolio, operating across several major sectors including agriculture, mining, infrastructure, transportation, and hospitality. Notably, the company is involved in the management and ownership of luxury hotel brands, such as St. Regis, Four Seasons, and Sheraton.

Analysis and potential impact

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. Despite international efforts to disrupt its infrastructure in February 2024, the group appears to have resumed its operations. The alleged leak of sensitive identification documents, such as passport and ID card copies, significantly increases the risk of identity theft for the individuals whose data was compromised.

Given the diverse sectors in which Rajawali Group operates—particularly in hospitality and infrastructure—this incident could pose significant risks to customer privacy and supply chain security. The exposure of financial and audit documents can also damage corporate trust and operational stability. Furthermore, the company may face legal challenges under Indonesian data protection regulations due to the nature of the leaked information. There is also a high probability that the stolen data could be utilized in secondary attacks, such as targeted phishing campaigns or other fraudulent activities.

For organizations operating in similar high-stakes sectors, maintaining robust cybersecurity postures is essential. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Additionally, organizations must ensure compliance with local data protection laws to mitigate the legal and reputational consequences of a potential breach.