Lockbit3 claims data breach against rodo.co.uk

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: December 17, 2023

LockBit3 claims to have exfiltrated data from rodo.co.uk

The LockBit3 ransomware group has published an announcement on its leak site, claiming to possess a significant volume of data belonging to the United Kingdom-based organization rodo.co.uk. According to the group's claims, the breach involves approximately 201 GB of information, which was announced on December 17, 2023. This incident follows a pattern of activity associated with the ransomware-as-a-service group, which has been active since 2019 and previously faced international law enforcement disruption in February 2024 before reportedly resuming its operations.

Details of the alleged attack and data theft

The group listed rodo.co.uk on its leak site on December 17, 2023, claiming that the attack occurred on the same day. The group asserts that they have successfully obtained a vast amount of sensitive information. While the specific ransom demand has not been disclosed, the group's claim focuses on the scale of the data exfiltrated during the operation. This type of activity is characteristic of modern ransomware groups that utilize double-extortion tactics, where attackers not only encrypt a victim's systems but also threaten to leak sensitive data to pressure the organization into paying a ransom.

According to the leak announcement, the compromised data allegedly includes a wide variety of sensitive corporate and personal information. The specific types of data claimed to be involved include:

• Employee passport scans
• Employee payroll and HR records
• Customer databases
• Financial reports and tax returns
• Production plans and technical drawings

The breadth of this claimed data suggests a deep penetration into the organization's internal systems, potentially touching upon multiple departments from human resources and finance to production and sales.

About rodo.co.uk

Rodo is a British company that operates within the manufacturing and supply sector. The company manufactures and supplies paint brushes, roller sleeves, and various decorating accessories. It serves a diverse market by offering a wide range of products designed for both professional decorators and the DIY market.

Security implications and organizational risks

The nature of the allegedly leaked data poses significant risks to both the organization and the individuals involved. The exposure of employee passport scans and payroll information creates a high risk of identity theft and targeted phishing attacks against the staff members. Furthermore, the alleged theft of customer databases and financial documents could lead to significant reputational damage and compromise the security of the organization's supply chain.

From a regulatory perspective, given that the organization is located in the United Kingdom, this incident may be subject to investigation under the UK GDPR. The exposure of corporate intellectual property, such as production plans and technical drawings, could potentially impact the company's operational continuity and competitive standing in the manufacturing market.

In such scenarios, organizations typically face the challenge of managing both the technical recovery of their systems and the legal and reputational fallout of a data leak. For companies in the manufacturing sector, protecting technical drawings and production plans is critical for maintaining competitive advantages. General defensive measures for organizations facing such threats often include implementing robust access controls, enhancing monitoring of data exfiltration, and ensuring comprehensive employee training to mitigate the risk of phishing-based entry points.