LockBit2 ransomware group lists centralia.edu on its leak site

• Ransomware group: LockBit2
• Country: United States
• Sector: Education
• Announcement date: February 19, 2022

LockBit2 claims data compromise at centralia.edu

The LockBit2 ransomware group has published a leak announcement targeting centralia.edu. By listing the domain on their dedicated leak site, the group claims to have successfully compromised data belonging to the institution. This announcement, which surfaced on February 19, 2022, marks a significant development in the group's ongoing campaign of extortion and data exposure.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, threat actors not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive information. The threat of leaking this data publicly serves as additional leverage to pressure the victim into paying a ransom. If the ransom is not met, the attackers threaten to release the stolen information to the public or to specific stakeholders.

Details of the claimed incident

According to the announcement made by the LockBit2 group, the incident was identified on February 19, 2022. The group has threatened to publish the institution's data in connection with this specific event. Despite the threat of publication, the group has not provided specific information regarding the ransom amount or the volume of the compromised data. Furthermore, the announcement does not include details regarding the specific file count or the exact nature of the data involved.

The group's communication regarding this breach remains limited in scope. No screenshots or detailed information regarding the nature of the leaked data have been provided in the announcement. This lack of transparency is common in early-stage leak site postings, where the primary goal is to signal the compromise and initiate the extortion process before providing further details or proof of theft.

Data involved in the claim

The listing names no specific data types or categories of information that have been compromised.

About Centralia College

Centralia College is a public community college located in Washington state. The institution offers various associate degrees and vocational training programs to its student body and community.

Analysis and potential implications

This incident may indicate potential vulnerabilities in the institution's data security protocols. If the claims made by the LockBit2 group are verified, the exposure of student and staff information could lead to identity theft or targeted phishing attacks. Such attacks on educational institutions may pose legal compliance risks under regulations such as FERPA.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. This specific record originates from their LockBit 2.0 period. It is worth noting that the group's infrastructure was disrupted by an international operation in February 2024. As a secondary risk, the leaked data may be utilized by other threat actors, potentially leading to a chain of subsequent cyberattacks against the institution or its affiliates.

To defend against such threats, organizations in the education sector can implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication across all services, and conducting regular security awareness training for staff and students. Additionally, maintaining strict adherence to data protection regulations and conducting frequent vulnerability assessments can help mitigate the risks associated with data exfiltration and unauthorized access.