Lockbit3 claims data breach against dothanhauto.com

• Ransomware group: Lockbit3
• Country: Vietnam
• Sector: Manufacturing
• Announcement date: October 9, 2023

LockBit3 claims to have stolen data from dothanhauto.com

The LockBit ransomware group has listed the Vietnamese organization dothanhauto.com on its dedicated leak site. According to the group's announcement, they claim to have successfully compromised the company's systems and now possess a significant amount of stolen information. This listing follows the common pattern of double extortion, where threat actors not only encrypt an organization's systems but also threaten to publish sensitive data on a public leak site to increase pressure for ransom payments.

The group's announcement was made on October 9, 2023, the same day they claim the attack occurred. While the group has claimed to have exfiltrated over 100 GB of data, they have not provided any information regarding a specific ransom demand. The threat actors have threatened to publish the stolen information if their demands are not met, a tactic used to maximize the reputational and operational damage to the target organization.

Details of the claimed incident

The incident involves a claimed ransomware attack targeting the operational infrastructure of the victim. The LockBit group has provided samples of documents to support their claims, which appear to be related to the core business functions of the target. These samples include various forms and charts that seem to be directly connected to the manufacturing and logistical operations of the company.

Based on the information provided by the threat actors, the data involved in this alleged breach includes:

• Commercial vehicle production records
• Inventory and logistics documents

The presence of these documents suggests that the attackers may have gained access to internal processes that are vital to the company's day-to-day manufacturing and supply chain management.

About Do Thanh Auto Corporation

Do Thanh Auto Corporation is a prominent automotive manufacturer located in Vietnam. The company specializes in the assembly, distribution, and warranty services for a variety of vehicles, including commercial vehicles, trucks, and specialized vehicles. It is recognized as one of the prestigious automobile manufacturers operating within the region.

Analysis and potential impact

The data shared by the LockBit group poses a significant risk of exposing sensitive information regarding the company's internal operational processes. The content of the leaked documents could potentially create negative impacts on the company's supply chain and its broader commercial activities. Because the company is based in Vietnam, the breach may lead to compliance issues regarding local data protection regulations.

Furthermore, the publication of such data can trigger secondary risks for the company's customers and business partners. These risks include the potential for identity theft or the execution of targeted phishing attacks against stakeholders. The exposure of logistics and inventory data can provide malicious actors with insights into the company's supply chain, potentially enabling more sophisticated social engineering or supply chain attacks.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored by security researchers since 2019. Although the group's infrastructure was disrupted by an international law enforcement operation in February 2024, reports indicate that the group has since resumed its operations. Organizations in the manufacturing sector often face similar threats and can take defensive steps such as implementing robust network segmentation, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of such incidents.