Lockbit3 claims data breach against bkf-fleuren.de

• Ransomware group: Lockbit3
• Country: Germany
• Sector: Manufacturing
• Announcement date: December 24, 2023

The LockBit3 ransomware group has listed data on its leak site, claiming the information belongs to the German organization bkf-fleuren.de. This announcement, which appeared on December 24, 2023, marks a recent addition to the group's list of targets, involving a company operating within the manufacturing sector.

The alleged attack event

According to the post made by the LockBit group on its leak site, the entity bkf-fleuren.de was targeted in a cyberattack. The group claims to have carried out this action on December 24, 2023. To support their claims of a successful breach, the group has published various screenshots of documents that they assert belong to the organization.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly if a ransom is not paid. By posting screenshots, the group attempts to provide visual evidence of the stolen data to pressure the victim into compliance.

Data involved in the leak

The screenshots provided by the group in their announcement contain various types of sensitive information. The content of these images suggests that the breach involves both personal and corporate information. The specific types of data mentioned in the listing include:

• Employee personal data
• Address information
• Corporate documents

While the group has provided screenshots to demonstrate the nature of the stolen information, no specific details were provided regarding the total size of the data or the exact number of files involved in the incident. Additionally, no ransom demand has been specified in the public announcement.

About bkf-fleuren.de

BKF A. Fleuren GmbH is a family-owned business that has been in operation since 1974/75. The company specializes in the production of plastic window systems. It maintains a significant operational footprint, employing approximately 100 people and operating across a production area that exceeds 20,000 square meters.

Implications and security considerations

The alleged leak of this data poses several significant risks. The exposure of personal information belonging to the organization's employees may increase the risk of identity theft. Furthermore, because the organization is based in Germany, this incident could trigger mandatory data breach notification obligations under the General Data Protection Regulation (GDPR).

The potential impact on the organization extends beyond privacy concerns. There are risks to operational continuity and the company's commercial reputation. Furthermore, given the historical patterns of the LockBit group, there is a possibility that the leaked data may be utilized for secondary attacks, such as targeted phishing campaigns, against the organization or its contacts.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored by security researchers since 2019. Although its infrastructure was disrupted by an international operation in February 2024, it has been reported to have resumed its operations following that disruption.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include maintaining regular, offline backups, implementing multi-factor authentication, and conducting regular employee training to recognize phishing attempts. Maintaining a comprehensive incident response plan is also a critical component of organizational resilience against ransomware threats.