Lockbit2 lists edm-stone.com on leak site

• Ransomware group: Lockbit2
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: May 26, 2022

The Lockbit2 ransomware group has announced the listing of the domain edm-stone.com on its dedicated leak site. Through this announcement, the group claims that the organization's data has been compromised.

The claimed attack and event details

According to the information provided by the threat actor, the listing of edm-stone.com was made on May 26, 2022. The group's announcement serves as a public claim that they have successfully targeted the organization and gained access to its digital environment.

Ransomware groups often utilize leak sites to exert pressure on their victims. These platforms are used to host announcements and, in many cases, samples of stolen information to coerce organizations into paying ransoms. This tactic is a cornerstone of modern cyber extortion, where the threat of public exposure is used as leverage during negotiations.

Data involvement and specifics

Regarding the specific nature of the breach, there is no screenshot or detailed information available regarding the nature of the leaked or threatened data. The listing does not provide specifics regarding the types of files or the volume of information involved.

The listing names no data types.

Organization profile

EDM Stone is a Turkish company operating in the natural stone, marble, and granite industry, focusing on production and export. Based in Istanbul, the company provides services in the processing and supply of various stone products.

Risk assessment and industry implications

This incident may indicate a potential risk of data exposure for the organization. If a data breach has occurred, secondary risks such as identity theft or targeted phishing attacks against employees and customers may be observed. When sensitive information is leaked, attackers often use it to conduct more sophisticated social engineering campaigns, targeting specific individuals within the organization or their external partners.

LockBit is a ransomware group that has been active since 2019, operating under a Ransomware-as-a-Service (RaaS) model until international operations disrupted its infrastructure in 2024. The RaaS model allows specialized developers to lease their malicious software to affiliates, who then carry out the actual attacks, creating a highly scalable ecosystem for cybercrime.

Depending on the sector and the region of the organization, legal processes under relevant data protection regulations may be triggered. Organizations in the manufacturing and export sectors must remain vigilant, as they often handle complex supply chain data and international client information. Defensive measures typically include maintaining robust backup strategies, implementing multi-factor authentication, and ensuring continuous monitoring of network traffic to detect unauthorized access early.