Lockbit3 claims data breach against crowe.com.za

• Ransomware group: Lockbit3
• Country: South Africa
• Sector: Financial Services
• Announcement date: January 29, 2024

Lockbit3 claims a significant data breach at crowe.com.za

The Lockbit3 ransomware group has announced that it has successfully exfiltrated a large volume of data from the systems of crowe.com.za. According to the announcement posted on their leak site on January 29, 2024, the threat actor group claims to have gained unauthorized access to the organization's environment and extracted a substantial amount of information.

The breach was reported on the same day the group claims to have carried out the attack. This type of announcement is a common tactic used by ransomware groups operating under a Ransomware-as-a-Service (RaaS) model. In such scenarios, attackers often employ double extortion techniques, where they not only encrypt an organization's data to disrupt operations but also threaten to leak sensitive information on public forums to pressure the victim into paying a ransom.

Details of the alleged exfiltration

The Lockbit3 group claims that the total volume of data stolen from crowe.com.za amounts to 150 GB. According to the group's claims, the stolen data includes critical information such as email server archives. The threat actors have indicated that the breach involves various types of sensitive documentation and records that could be highly damaging if disclosed.

Based on the information provided by the group, the following data types are allegedly included in the leak:

• Customer data
• HR records
• Email archives
• Identity information

The group has provided evidence to support their claims, including screenshots that purportedly show identity card samples and email archive files in .pst format. This type of evidence is frequently used by ransomware groups to demonstrate the legitimacy of their breach to both the victim and the public.

About crowe.com.za

Crowe South Africa is a professional services firm that provides a variety of specialized services, including audit, tax, and advisory services. As a member of the Crowe Global network, the organization provides strategic consulting and financial solutions to businesses operating across a wide range of different industries.

Potential risks and industry implications

The alleged breach of crowe.com.za carries significant implications for the organization and its stakeholders. The sensitivity of the claimed data, which includes identity information and HR records, may pose secondary risks such as identity theft and the possibility of targeted phishing attacks directed at the organization's employees and customers.

Furthermore, because crowe.com.za operates within the financial services sector, the leak of such sensitive information could lead to significant compliance challenges regarding South African data protection regulations, specifically the Protection of Personal Information Act (POPIA). The exposure of customer and internal data can negatively impact an organization's operational reliability and create vulnerabilities within the broader supply chain security.

The Lockbit3 group has been an active RaaS provider since 2019. It is worth noting that while international law enforcement operations disrupted the group's infrastructure in February 2024, observations indicate that the group continues to carry out its malicious activities. For organizations in the financial sector, maintaining robust defensive measures is essential to mitigate the risks of data exfiltration and ensure compliance with regional data protection standards.