Lockbit3 claims data breach against gitiusa.com

• Ransomware group: Lockbit3
• Country: United States
• Sector: Manufacturing
• Announcement date: November 8, 2023

LockBit3 claims to have compromised gitiusa.com data

The LockBit3 ransomware group has published a leak announcement on its platform, claiming to have compromised data belonging to gitiusa.com. According to the announcement, the threat actor claims to have accessed a significant volume of information related to the organization's operations in the United States. The group has initiated a countdown for the publication of the alleged stolen data, a common tactic used to increase pressure on the target organization.

Details of the alleged attack

On November 8, 2023, the LockBit group listed gitiusa.com on its leak site. The threat actor claims to have accessed more than 100,000 files related to the organization's US operations. While the specific date of the initial attack is cited as October 28, 2023, the official listing occurred in November. The group's announcement suggests a large-scale exfiltration of corporate and personal information.

The leak is claimed to contain several types of sensitive information. Based on the group's claims and the provided evidence, the following data types are allegedly involved:

• Employee personal data
• Financial reports
• Tax returns
• Technical documentation

Furthermore, the group has provided screenshots as proof of the breach, which reportedly display samples of identification cards and personnel lists.

About GITI Tire USA

GITI Tire USA is the United States division of GITI Tire, which is recognized as one of the largest tire manufacturers globally. The company provides a wide range of tire solutions for various vehicle types, including passenger vehicles, light trucks, and commercial vehicles.

Analysis and potential implications

LockBit is a ransomware group that has been observed since 2019. The group faced international disruption in February 2024 before reportedly resuming its operations. This specific breach may pose secondary risks to the organization's employees, such as identity theft and targeted phishing attacks, due to the nature of the alleged stolen data. As a US-based entity, the potential data breach may lead to legal consequences under state-level privacy laws and sectoral regulations.

The disclosure of corporate data could negatively impact the company's commercial reputation and intellectual property rights. The group's use of a double extortion tactic—whereby they threaten to publish stolen data if a ransom is not paid—is intended to increase the pressure on the organization to comply with their demands.

In general, ransomware leak sites serve as a public stage for threat actors to shame their victims. By publishing sensitive documents, attackers aim to maximize the reputational damage and operational disruption caused by the initial encryption of systems. Organizations facing such threats often focus on defensive strategies such as robust backup management, multi-factor authentication, and continuous monitoring to mitigate the impact of such incidents. The complexity of these attacks highlights the ongoing challenge of protecting sensitive corporate and personal information from sophisticated ransomware groups.