Lockbit3 claims data breach against grouplease.co.th

• Ransomware group: Lockbit3
• Country: Thailand
• Sector: Financial Services
• Announcement date: April 11, 2023

LockBit3 claims data breach against grouplease.co.th

The LockBit ransomware group has listed the Thailand-based financial services firm grouplease.co.th on its leak site. The threat actor claims to have obtained data belonging to the organization and has announced plans to publish the information. This announcement was made on the group's leak site on April 11, 2023, with the group claiming the attack occurred on the same date.

Details of the alleged data leak

According to the claims made by the LockBit group, the breach involves various documents related to the company's operations. To support their claims, the threat actor has provided sample images of different documents. Furthermore, the group has initiated a countdown timer, signaling a deadline for the intended publication of the alleged data.

The screenshots provided by the attackers display several types of internal information. The specific types of data mentioned in the listing include:

• Internal correspondence
• Financial documents
• Approval forms

While the group has provided these visual samples, no specific information was provided regarding the total size of the data stolen, the total file count, or the specific ransom demand being sought by the attackers.

About grouplease.co.th

Group Lease Public Company Limited is a financial services company. The organization provides a variety of services including consumer finance, hire purchase services, and asset-backed loans. Its operations are centered in Thailand and extend to various countries across Southeast Asia.

Analysis and potential impact

This leak claim may create negative impacts on the organization's customers and operational processes. The exposure of financial data could increase risks of identity theft and fraud for customers. Additionally, the organization may face legal obligations under Thailand's data protection regulations due to the potential exposure of sensitive information.

The leaked data may provide a basis for secondary attacks and targeted phishing attempts against the organization or its clients. The nature of the documents, which include internal correspondence and financial statements, can be leveraged by attackers to craft more convincing social engineering campaigns.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It has been reported to have resumed operations following international law enforcement actions in February 2024. Ransomware groups like LockBit often employ double extortion tactics, where they not only encrypt an organization's data but also threaten to leak sensitive information on public platforms to pressure the victim into paying a ransom.

In such scenarios, organizations in the financial services sector often focus on strengthening their defensive posture through various measures. This typically includes implementing robust data encryption, enhancing monitoring of internal networks to detect unauthorized access, and conducting regular security awareness training to protect against phishing. Maintaining strict access controls and ensuring compliance with regional data protection laws are also critical components of a modern cybersecurity strategy.