LockBit3 claims data breach against smithandcaugheys.co.nz

• Ransomware group: LockBit3
• Country: New Zealand
• Sector: Professional Services
• Announcement date: June 2, 2024

LockBit3 targets smithandcaugheys.co.nz in alleged data breach

The LockBit3 ransomware group has listed the organization smithandcaugheys.co.nz on its dedicated leak site. According to the announcement made on June 2, 2024, the threat actors claim to have successfully exfiltrated sensitive information belonging to the New Zealand-based professional services firm. This development follows the group's established pattern of using public leak sites to pressure victims through the threat of data exposure.

Details of the alleged attack

The threat actor's announcement, dated June 2, 2024, asserts that they have gained access to internal information belonging to several critical departments within the organization. The group has specifically claimed to possess data originating from the following areas:

• Financial data
• HR data
• Accounting records
• Management data
• IT system data

The group has reportedly provided a deadline for the situation, indicating that the data may be released publicly if their demands are not met by June 4, 2024. While the group has made these claims, the specific volume of data and the exact file count have not been disclosed in the announcement. Furthermore, no specific ransom demand has been made public at this time.

The threat actor: LockBit3

LockBit3 is a known Ransomware-as-a-Service (RaaS) entity that has been active in the cyber threat landscape since 2019. The group has demonstrated significant resilience; despite facing major international law enforcement actions in February 2024, reports indicate that the group has since resumed its operations. This resurgence highlights the ongoing challenges posed by RaaS models, where specialized developers provide ransomware tools to affiliates to conduct attacks, making the ecosystem difficult to dismantle entirely.

Risks and implications of the breach

The alleged compromise of data from finance, human resources, accounting, management, and IT departments poses several significant risks to the organization. If the claimed data is indeed leaked, it could lead to a high risk of identity theft or targeted phishing attacks against the organization's employees and its various business partners. Such attacks often leverage stolen internal details to craft highly convincing social engineering campaigns.

From a regulatory perspective, the organization may be required to fulfill specific data breach notification obligations under New Zealand's Privacy Act 2020. Beyond legal compliance, the potential disclosure of data through double extortion tactics—a method where attackers both encrypt data and threaten to leak it—represents a major secondary risk factor. Double extortion tactics are designed to maximize pressure on an organization by threatening its commercial reputation and operational continuity.

For organizations operating in the professional services sector, such incidents underscore the necessity of robust defensive measures. Common industry practices to mitigate these risks include maintaining rigorous patch management schedules, implementing multi-factor authentication across all systems, and conducting regular security awareness training for staff. Furthermore, maintaining offline, immutable backups and implementing strict network segmentation can help limit the lateral movement of attackers and ensure that data remains protected even if a perimeter is breached.