Lockbit3 claims data breach against seiu1000.org

• Ransomware group: Lockbit3
• Country: United States
• Sector: Government & Defense
• Announcement date: January 19, 2024

Lockbit3 claims data breach against seiu1000.org

The Lockbit3 ransomware group has listed 308 GB of data allegedly belonging to seiu1000.org on its leak site. This announcement, made on January 19, 2024, marks a significant potential breach for the organization, as the threat actors claim to have successfully exfiltrated a massive volume of sensitive information.

Details of the alleged attack

According to the announcement posted on the group's leak platform, the attack was claimed to have occurred on January 19, 2024. The threat actors behind Lockbit3 claim to have obtained sensitive data belonging to the organization's employees and business partners. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to pressure the victim into paying a ransom by threatening to leak the information publicly.

The group has reportedly set a deadline for the publication of the mentioned data, a common tactic used to create urgency and pressure the target organization into compliance. While the specific ransom demand was not disclosed in the announcement, the threat of data exposure remains a primary tool for these groups to exert influence over their targets.

The scope of the claimed data theft

The data allegedly stolen by the Lockbit3 group is extensive and covers a wide range of sensitive personal and corporate information. The claim suggests that the breach includes highly confidential records that could be used for various malicious purposes. The specific types of data mentioned in the leak include:

• Employee identification data
• Financial records
• Partner personal data
• Tax returns
• Bank statements

Beyond these categories, the group claims to have access to employee SSN numbers, residential ID, phone, email, DOB, salary information, 401(k) forms, financial reports, personal information of partners, NDAs, and SQL databases. The presence of such diverse data types, ranging from personal identification to complex database structures, highlights the potential depth of the unauthorized access.

About Service Employees International Union (SEIU) Local 1000

Service Employees International Union (SEIU) Local 1000 is the largest public sector union in California, representing approximately 96,000 employees working for the State of California. Based in Sacramento, the organization advocates for the labor rights and benefits of its members.

Potential risks and implications

The alleged leak may pose significant risks of identity theft and fraud for the organization's employees and business partners. Given the region of operation, data breach notification obligations under CCPA and relevant state laws may arise. The exposure of personal identifiers like SSNs and bank statements significantly increases the risk of targeted phishing campaigns or secondary attacks against the individuals involved.

Furthermore, such a breach can have negative impacts on the organization's operational continuity and reputation management. For organizations in the government and defense sector, maintaining the integrity of employee and partner data is critical to public trust. Considering the past activities of the Lockbit group, it is possible that the allegedly leaked data could be used in secondary attacks or targeted phishing campaigns. It is worth noting that Lockbit is a RaaS (Ransomware-as-a-Service) group that has been monitored since 2019, and it is reported to have resumed operations following an international operation in February 2024.

Defensive considerations for organizations

To mitigate the risks associated with such breaches, organizations typically focus on robust identity and access management, continuous monitoring of network traffic, and comprehensive data encryption strategies. Implementing strict data loss prevention (DLP) measures and ensuring regular, offline backups are also standard defensive steps to protect against the dual threat of encryption and data exfiltration.