LockBit2 ransomware group lists vbhlaw.com on its leak site

• Ransomware group: LockBit2
• Country: United States
• Sector: Professional Services
• Announcement date: January 27, 2022

LockBit2 claims data breach against Vandeventer Black LLP

The LockBit2 ransomware group has published an announcement claiming that data belonging to the entity with the domain vbhlaw.com has been leaked. This announcement was made as part of the group's activities in early 2022.

Details of the alleged attack

According to the claims made by the threat actors, the LockBit2 group listed the domain vbhlaw.com on their leak site on January 27, 2022. The group claims to have successfully gained access to the organization's networks and subsequently exfiltrated data. This incident was officially announced on the group's leak site on January 27, 2022, coinciding with the date the attack was allegedly carried out.

Ransomware groups often utilize leak sites to exert pressure on their targets through a tactic known as double extortion. In such scenarios, attackers do not only encrypt an organization's systems but also steal sensitive information, threatening to release it publicly if a ransom is not paid. This method increases the leverage held by the cybercriminals, as the threat of exposing confidential information can be more damaging than the operational disruption caused by encryption.

Information regarding the leaked data

Regarding the specifics of the alleged breach, the group has not provided any details regarding the nature of the allegedly leaked data. No samples of the data have been provided, and there is no screenshot available to verify the contents of the breach. The listing names no specific data types.

Organization profile

Vandeventer Black LLP is a law firm based in the United States. The organization provides legal consulting and advocacy services across various sectors.

Risk assessment and industry implications

This incident may pose a risk of exposing the organization's sensitive data. The alleged data breach could have negative impacts on client confidentiality and trade secrets due to the organization's operations in the professional services sector. When a law firm is targeted, the potential exposure of sensitive legal documents and client communications represents a significant risk to the trust established between the firm and its clients.

The publication of an organization's data by a ransomware group may lead to secondary risks. These include the possibility of targeted phishing attacks or identity theft attempts against the organization or its clients. Furthermore, depending on the jurisdiction and the nature of the data, the organization may be required to fulfill data breach notification obligations under relevant regulations.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. The group has been known to actively conduct ransomware attacks, with operations continuing until 2024. Organizations in the professional services sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust encryption for data at rest and in transit to mitigate these types of risks. Maintaining comprehensive logging and monitoring is also a common practice to detect unauthorized network access more effectively.