Lockbit3 claims data breach against itss.com.tr

• Ransomware group: Lockbit3
• Country: Türkiye
• Sector: Technology
• Announcement date: May 9, 2024

Lockbit3 claims to have compromised itss.com.tr

The Lockbit3 ransomware group has officially listed the Turkish technology firm itss.com.tr on its dedicated leak site. According to the announcement made on May 9, 2024, the threat actor group claims to have successfully compromised the organization's systems and intends to publish the acquired data. This development follows a timeline provided by the group, which suggests that they may have maintained access to the organization's internal systems as of March 18, 2024.

Ransomware attacks of this nature often involve a strategy known as double extortion. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to release stolen data on public leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information, which could lead to significant reputational and legal consequences.

Details of the claimed data exposure

While the specific volume of the stolen data and the exact ransom demand remain unknown, the group has provided visual evidence to support their claims. Screenshots shared by the attackers suggest that the breach involves a variety of sensitive documents. The content identified in these samples indicates that the breach has exposed critical business and personal information.

The types of data reportedly involved in this incident include:

• Financial data
• Contracts
• Identity information
• Corporate correspondence

The presence of such diverse data types—ranging from financial statements to identity card images—highlights the potential depth of the intrusion into the organization's digital environment.

About itss.com.tr

ITSS is a technology company based in Türkiye. The organization specializes in providing a wide range of IT infrastructure solutions to its corporate clients. Their service portfolio includes system integration, cybersecurity services, and managed services, positioning them as a provider of critical technical support and security for various businesses.

Risk assessment and potential consequences

The exposure of the data claimed by Lockbit3 carries significant risks for both the organization and the individuals whose information was involved. For the organization, the leak of trade secrets and personal data could lead to serious legal sanctions under regulations such as the Law on the Protection of Personal Data (KVKK). Furthermore, the group's history suggests that beyond mere data leakage, the operational continuity of the organization could be directly impacted by such attacks.

For the affected parties, including employees and customers, the breach creates secondary risks. These include the potential for identity theft and the execution of highly targeted phishing attacks, where attackers use stolen corporate correspondence or personal details to craft convincing fraudulent communications.

The threat posed by Lockbit3 is considered high. The group has been active since 2019 and has demonstrated a high level of resilience, reorganizing itself even after international law enforcement interventions in February 2024. This persistence makes them a formidable adversary in the cyber threat landscape.

In response to such incidents, organizations typically face the necessity of fulfilling data breach notification obligations to regulatory bodies and informing the parties affected by the exposure. To mitigate the impact of such threats, companies in the technology and managed services sector often focus on strengthening their defensive postures through robust access controls, continuous monitoring, and comprehensive incident response planning to ensure they can react effectively when a compromise is detected.