Lockbit3 claims data breach against elements-ing.com

• Ransomware group: Lockbit3
• Country: France
• Sector: Professional Services
• Announcement date: May 9, 2024

LockBit3 claims to have stolen data from elements-ing.com

The LockBit3 ransomware group has listed elements-ing.com on its leak site, claiming to have obtained the organization's data. This announcement, made on May 9, 2024, follows a period of alleged unauthorized access to the company's internal systems.

According to the claims made by the ransomware group, the breach occurred much earlier than the public announcement. The group alleges that they gained access to the organization's systems on March 18, 2024. While the group has posted the organization's name on their platform, they have not provided information regarding the total size of the data stolen or the specific number of files involved. Furthermore, there is no information available concerning a ransom demand or any official statement from the victimized entity.

Details of the alleged data leak

The announcement provided by the group includes samples of documents that appear to be related to the organization's operations and various projects. These samples serve as evidence for the group's claims of a successful intrusion. Based on the provided screenshots, the leaked information appears to consist of sensitive corporate documentation used in day-to-day business activities.

The documents identified in the leak include:

• Corporate contracts
• Financial proposals
• Technical reports

The presence of such documents on a leak site is a hallmark of double extortion tactics. In these scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release confidential files, attackers aim to pressure victims into paying a ransom to prevent the public disclosure of proprietary or sensitive information.

About elements-ing.com

Eléments Ingénieries is a professional services firm based in France. Founded in 2004 under the name RFR éléments, the company specializes in the fields of environment, energy, and fluid systems. As an engineering firm, the organization manages complex technical projects and sensitive operational data related to infrastructure and environmental management.

Risk assessment and industry implications

This alleged leak may pose a significant risk of exposing the organization's trade secrets and operational data. Because the organization is based in France, the leaked data may fall under the scope of the European Union's General Data Protection Regulation (GDPR), which mandates strict protections for personal and sensitive data. The disclosure of technical reports and contract drafts could potentially be utilized by malicious actors to launch targeted phishing attacks against the organization's third-party partners or clients, thereby creating substantial supply chain risks.

The persistence of the LockBit group is a notable concern for the cybersecurity community. The group has been active since 2019, and despite international law enforcement operations aimed at disrupting its infrastructure, reports indicate that it has resumed operations. This suggests that the group's attack capabilities may persist despite significant global pressure.

For organizations operating in the professional services and engineering sectors, these types of incidents highlight the necessity of robust defensive postures. To mitigate the risks of data exfiltration, companies often implement multi-layered security strategies. This includes strict access controls to limit the movement of attackers within a network, comprehensive encryption for data at rest and in transit, and continuous monitoring to detect anomalous behavior. Furthermore, because leaked documents can be used for social engineering, maintaining high levels of awareness regarding phishing and verifying the identity of third parties is a critical component of modern organizational defense.