Lockbit3 claims data breach against bauscherhepp.com

• Ransomware group: Lockbit3
• Country: Canada
• Sector: Retail & E-Commerce
• Announcement date: September 20, 2023

The LockBit3 ransomware group has issued an announcement on its leak site claiming to have breached and leaked data belonging to the organization bauscherhepp.com. This latest claim follows a pattern of double extortion, a tactic where threat actors not only encrypt an organization's systems but also threaten to publish sensitive information on public leak sites to pressure the victim into paying a ransom.

The claimed attack event

According to the announcement posted on September 20, 2023, the LockBit3 ransomware group targeted bauscherhepp.com. The group's notice indicates that the attack occurred on the same day the announcement was made, September 20, 2023. The threat actors have asserted that they have successfully exfiltrated various types of information from the organization's internal systems.

The group has employed a high-pressure tactic by stating that the entirety of the stolen data will be published on their leak site if the ransom demand is not met. While the specific amount of the ransom demand has not been disclosed in the announcement, the threat of full data exposure remains the primary lever used by the group to coerce the organization.

The data claimed to be involved

The LockBit3 group has made specific claims regarding the nature of the files they have allegedly obtained from the victim's infrastructure. The announcement suggests that the breach involves several categories of digital assets that could be highly sensitive to the company's operations.

The group claims to have obtained the following items:

• File lists
• SQL dumps
• Various file samples

The presence of SQL dumps is particularly significant in such breaches, as these databases often contain structured information that may include sensitive records. No specific quantity of files or the total size of the data exfiltrated has been provided in the group's claim.

Organization profile

BauscherHepp is a distributor of professional porcelain, cutlery, and glassware specifically serving the hospitality and restaurant industry. The company plays a significant role in the North American market, representing several leading global brands such as Bauscher, Hepp, Tafelstern, WMF, and Luigi Bormioli.

Risk assessment and industry implications

This incident poses significant risks to the organization's operational continuity and its commercial reputation. For a company operating within Canada, such a breach may trigger legal obligations under local data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA). The alleged exposure of SQL dumps is a major concern, as it could imply that customer or employee data has been compromised, potentially leading to secondary risks such as identity theft or targeted phishing attacks against the organization's stakeholders.

The group involved, LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Although its infrastructure faced a significant disruption in February 2024, it has been reported that the group has since resumed its operations. The publication of data from a distributor like BauscherHepp can also create secondary risks for various supply chain partners who interact with the company.

In the retail and e-commerce sectors, organizations often face these types of threats due to their high volume of transactions and sensitive customer data. To defend against such threats, organizations typically implement layered security strategies. This includes maintaining robust, offline backups to ensure operational continuity, implementing strict access controls to limit the movement of attackers within a network, and conducting regular monitoring to detect unauthorized data exfiltration. Furthermore, because these groups often target the supply chain, maintaining high security standards is essential not just for the target organization, but for all its business partners to prevent cascading effects.