Lockbit3 claims data breach and system encryption at infosysbpm.com

• Ransomware group: Lockbit3
• Country: India
• Sector: Professional Services
• Announcement date: November 4, 2023

LockBit3 claims attack on Infosys BPM

The LockBit ransomware group has posted an announcement on its leak site claiming to have targeted the professional services organization infosysbpm.com. According to the threat actors, the organization has fallen victim to a significant cyberattack involving both data exfiltration and system encryption.

The claim suggests a high level of impact on the organization's infrastructure. The threat actors allege that they have successfully encrypted over 2000 systems belonging to infosysbpm.com. This level of encryption typically results in severe operational disruptions, as critical business systems become inaccessible to legitimate users, potentially halting day-to-day business processes.

Details of the alleged exfiltration

In addition to the encryption of systems, the LockBit group claims to have exfiltrated a substantial amount of sensitive information. The group asserts that they have stolen approximately 50 GB of data. The stolen information is reportedly gathered from files created or edited within the last 365 days. The group provided a file tree structure to demonstrate the scope of the files they claim to have accessed during the operation.

The threat actors have indicated that the organization did not meet their ransom demands. As a result of this refusal, the group has issued a threat to publish the stolen data publicly. This tactic is a hallmark of double extortion ransomware campaigns, where attackers not only encrypt data to disrupt operations but also steal it to pressure the victim into paying by threatening to leak sensitive information to the public or dark web forums.

Affected data types

The listing names no specific data types within the provided information.

About Infosys BPM

Infosys BPM is a subsidiary of the India-based Infosys. The company provides business process management and outsourcing services to various global corporations. Their operational scope includes developing solutions designed to enhance efficiency across multiple critical sectors, specifically including finance, insurance, and healthcare.

Potential impact and security implications

The claims made by the LockBit group could lead to significant disruptions in the operational processes of the organization. If the alleged data breach is confirmed and the data is leaked, secondary risks may emerge for the organization's stakeholders. These risks include the possibility of identity theft or the execution of targeted phishing attacks directed at the company's customers and employees.

Because the organization is an India-based entity, a confirmed data breach could trigger legal proceedings under local data protection regulations. The refusal of the organization to pay the ransom, as claimed by the attackers, increases the risk that the data may be sold to third parties or published openly on the internet.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite international law enforcement operations conducted in February 2024, the group continues to show signs of active operations. For organizations in the professional services sector, such incidents highlight the importance of robust defensive measures. Common defensive strategies include maintaining offline backups, implementing strict access controls, and continuously monitoring networks for unauthorized exfiltration activities to mitigate the impact of such high-scale attacks.