Lockbit3 claims data breach against el-cerrito.org

• Ransomware group: Lockbit3
• Country: United States
• Sector: Government & Defense
• Announcement date: August 9, 2023

The Lockbit3 ransomware group has listed el-cerrito.org on its leak site, claiming to have exfiltrated data from the organization. This announcement, made on August 9, 2023, marks a significant incident involving a local government entity in the United States.

The details of the claim

According to the announcement posted on the ransomware leak site, the Lockbit group listed el-cerrito.org on August 9, 2023. Upon making the listing, the group initiated a countdown timer, a common tactic used in ransomware extortion to pressure victims. The group stated that the organization's data would be published if their demands were not met. While the group has made these claims, the specific details regarding the ransom demand and the total volume of data taken remain unknown.

In many modern ransomware attacks, groups utilize a method known as double extortion. In this scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption occurs. This allows them to threaten the public release of stolen data on a leak site if the ransom is not paid, thereby increasing the pressure on the victim to comply.

Data involved in the leak

The group has shared samples of various documents to support their claim of a successful breach. These samples include various financial documents related to the organization's operations. Specifically, the shared content includes screenshots of financial payment documents, account statements, and invoices. The following types of data are identified as being affected by the claim:

• Financial documents
• Invoice information
• Payment records

The exposure of such documents can provide a foundation for further malicious activities, such as identity theft or highly targeted phishing attacks, as the information may contain sensitive details about financial transactions and organizational processes.

About el-cerrito.org

El Cerrito is a city located in Contra Costa County, California, United States. It is a local government entity that forms part of the San Francisco Bay Area. As a public service provider, the organization plays a vital role in the local community and manages various governmental functions for its residents.

Impact and organizational considerations

The claim made by Lockbit3 may pose a significant risk of exposing the personal data of citizens due to the organization's role in providing public services. Because the organization is based in the United States, a potential data breach could lead to complex legal consequences under various state laws and federal regulations. Such incidents often impact an organization's operational continuity and can lead to a loss of public trust.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Although its infrastructure was disrupted in February 2024, it has been reported to have resumed operations. This highlights the persistent nature of such threat actors.

For organizations operating within the government and defense sector, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, monitoring network traffic for unusual data exfiltration patterns can help identify potential breaches before data is leaked on public sites.