Lockbit3 claims data breach against cbcstjohns.co.za

• Ransomware group: Lockbit3
• Country: South Africa
• Sector: Education
• Announcement date: August 9, 2023

The LockBit3 ransomware group has claimed to have compromised data belonging to the South African educational institution cbcstjohns.co.za. The threat actor group listed the organization on its dedicated leak site, alleging that they have gained unauthorized access to the institution's data and are threatening to publish it.

The details of the claim

The announcement regarding the alleged breach was created on August 9, 2023. According to the claim made by the LockBit3 group, the institution's data has been accessed, posing a potential threat to the organization's ongoing operations. While the group has published a listing on their leak site, no information was provided regarding the total size of the data stolen, the specific file count, or the ransom demand required to prevent the publication of the information.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to release private data publicly, the attackers attempt to pressure the victim into paying a ransom to avoid reputational damage, legal consequences, or the exposure of private information.

Data involved in the alleged breach

Based on the screenshots provided by the threat actors, the documents visible contain various types of sensitive information. The leaked material reportedly includes personal information belonging to employees, specific employment details, and various administrative forms. The specific types of data identified in the listing include:

• Employee HR data
• Administrative records

The exposure of such information presents a significant risk, as administrative and human resources records often contain the foundational details required for identity theft or targeted phishing campaigns directed at the affected staff members.

About cbcstjohns.co.za

CBC St John’s is an independent Catholic school located in Parklands, South Africa. The institution provides education for children ranging from age 2 to Matric. Following the Edmund Rice tradition, the institution operates as a Christian Brothers College and maintains a focus on academic excellence.

Analysis and organizational implications

This alleged breach may pose a significant risk due to the potential exposure of employees' personal information. Under South Africa's POPIA (Protection of Personal Information Act), the institution may face mandatory data breach notification requirements. The exposure of such data can be leveraged by malicious actors for identity theft or highly targeted phishing attacks against the staff members involved.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. The group reportedly reorganized following an international disruption operation that occurred in February 2024. The persistence and evolving nature of RaaS models make them a continuous threat to various sectors, including education.

For organizations in the education sector, such incidents highlight the importance of robust data security protocols. To mitigate the risks associated with data exfiltration, it is advisable for institutions to review their security frameworks and ensure they are prepared to notify affected individuals in the event of a confirmed breach. Implementing strong access controls, regular security audits, and comprehensive data protection measures are standard defensive steps to protect sensitive administrative and personal information from unauthorized access.