Lockbit3 claims data breach at dsglobaltech.com

• Ransomware group: Lockbit3
• Country: Singapore
• Sector: Technology
• Announcement date: May 9, 2024

The LockBit ransomware group has claimed responsibility for a data breach involving dsglobaltech.com. According to an announcement made on the group's leak site, the organization's data has been targeted, and the threat actor group has initiated a countdown timer, signaling that the stolen information may be published publicly.

Details of the alleged attack

The incident involving dsglobaltech.com was officially announced on the LockBit3 leak site on May 9, 2024. While the announcement was made in May, the ransomware group alleges that it successfully gained unauthorized access to the organization's systems much earlier, specifically on March 26, 2024. This gap between the initial intrusion and the public announcement is a common occurrence in ransomware operations.

The threat actor group has utilized a countdown mechanism, a tactic often used in double extortion schemes. In such scenarios, ransomware groups do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to release the data on a public leak site, the attackers aim to pressure the victim into meeting ransom demands. The presence of a timer indicates that the group is actively moving through its extortion phase, creating a sense of urgency for the targeted entity.

Data types involved in the leak

Based on the screenshots provided by the attackers, the leaked information appears to consist of highly sensitive corporate documentation. The visual evidence suggests that the following types of data are involved in the alleged breach:

• Financial statements
• Balance sheet data
• Service reports

The exposure of these specific documents suggests a deep level of access into the organization's internal administrative and financial workflows.

About dsglobaltech.com

DS Global Technology is a technology firm headquartered in Singapore. The company provides a wide range of professional services, including end-to-end ICT services, communication engineering, and software development solutions. Their service portfolio is designed to support both small and medium-sized enterprises (SMEs) as well as large-scale enterprises.

Risk assessment and industry implications

The alleged theft of financial data presents significant risks to the organization's commercial operations and strategic planning. When sensitive financial information, such as balance sheets and financial statements, is exposed, it can undermine the company's competitive position. Furthermore, such a breach can lead to a loss of trust among clients and business partners, who may become concerned about the security of their own information when interacting with the firm.

From a regulatory perspective, because the organization is based in Singapore, the potential data breach may fall under the scope of the Singapore Personal Data Protection Act (PDPA). Organizations operating in the technology sector must remain vigilant, as the exposure of service reports and financial documents can also facilitate secondary attacks, such as targeted phishing or business email compromise, by providing attackers with context about the company's operations and clients.

The LockBit group remains a significant threat in the cybersecurity landscape. Active since 2019, the group operates under a Ransomware-as-a-Service (RaaS) model, which allows them to maintain a high level of operational capacity. Despite various international law enforcement operations aimed at disrupting its infrastructure, the group has demonstrated a notable ability to reorganize and continue its activities. For organizations in the technology and ICT sector, maintaining robust defensive postures, such as implementing multi-factor authentication, maintaining strict network segmentation, and conducting regular security audits, remains essential to mitigate the impact of such sophisticated threats.