Lockbit3 claims data breach against pkf.com.au

• Ransomware group: Lockbit3
• Country: Australia
• Sector: Professional Services
• Announcement date: August 30, 2024

The LockBit3 ransomware group has listed pkf.com.au on its leak site, claiming to possess data belonging to the organization. This announcement, which appeared on the group's platform, marks a new development in the ongoing activity of this ransomware-as-a-service (RaaS) entity.

The details of the claim

The LockBit group has listed the domain pkf.com.au on its leak platform, making claims against the organization. According to the records from the group, the entry was recorded in their system on August 30, 2024. Through this listing, the group alleges that it has successfully gained access to the organization's data.

Ransomware leak sites are frequently used by cybercriminal groups as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten the public release of that data if a ransom is not paid. This tactic places immense pressure on organizations to comply with financial demands to prevent reputational damage or regulatory scrutiny.

Data involved in the incident

Regarding the specific information targeted in this alleged attack, the group has not provided any details regarding the nature of the leaked or threatened data. The information currently available on the leak site is limited to a screenshot displaying the general verification interface of the platform. Consequently, the listing names no specific data types.

Organization profile

PKF Australia is an independent professional services firm providing accounting, audit, and business advisory services. The organization operates as a member of the PKF Global network, serving clients within the professional services sector.

Analysis and potential impact

This claim by the LockBit group may have a negative impact on the organization's operational processes. As an Australia-based entity, a potential data breach could be subject to the Australian Privacy Act 1988. Furthermore, secondary risks such as identity theft or targeted phishing attacks may emerge for the organization's clients and employees.

LockBit is a RaaS group that has been monitored since 2019. Despite experiencing a disruption in February 2024, the group has been reported to continue its operations. This situation may also indicate risks regarding the organization's supply chain security, as breaches in professional services firms can often serve as a gateway to the networks of their various clients and partners.

For organizations operating in the professional services sector, maintaining robust cybersecurity postures is essential to mitigate such risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough third-party risk assessments to secure the supply chain. Continuous monitoring and rapid incident response capabilities are also critical to minimizing the impact of potential unauthorized access.