Lockbit3 claims data breach at hetero.com

• Ransomware group: Lockbit3
• Country: India
• Sector: Healthcare
• Announcement date: May 9, 2024

The Lockbit3 ransomware group has listed the pharmaceutical manufacturer hetero.com on its leak site, claiming to have exfiltrated data from the organization. This announcement, made on May 9, 2024, follows a pattern of double extortion often utilized by such threat actors, where stolen data is threatened with public release to pressure victims.

The claimed attack details

According to the claims made by the Lockbit3 group, the breach occurred when threat actors gained access to the organization's network on May 2, 2024. The group published the listing on their platform on May 9, 2024, alleging that they successfully compromised the company's systems. To support their claims of a successful intrusion, the group has shared documents that appear to contain sensitive information related to the company's internal operations.

Ransomware groups typically use these leak sites to host stolen information, serving as a public pressure tactic. This method of extortion aims to damage a company's reputation or force a ransom payment by threatening to release proprietary information or private data. While the listing is a claim made by the threat actors, it highlights the ongoing risks faced by large-scale industrial organizations.

Data involved in the alleged leak

The information shared by the group as proof of the breach includes screenshots and documents that appear to contain highly sensitive information. The content of these files reportedly includes technical analysis reports related to pharmaceutical production processes and various laboratory data. Furthermore, the group has provided evidence of access to personnel records.

The specific types of data identified in the leak include:

• Employee HR data
• Technical production reports
• Laboratory analysis results

The documentation provided by the attackers reportedly contains employee lists that include specific details such as dates of birth, dates of joining, and department information. The presence of such granular data increases the risk of secondary attacks against the individuals involved.

Implications and risks

The allegedly leaked data may pose significant risks to the organization's intellectual property rights and employee privacy. For a company operating in the pharmaceutical sector, the disclosure of technical data regarding production processes could harm competitive advantage and pose risks to trade secrets. The loss of such sensitive information can impact a company's market position and long-term strategic goals.

Additionally, the publication of employee data may lead to the personnel being exposed to targeted phishing attacks. When personal details like department and hire dates are leaked, attackers can craft highly convincing social engineering campaigns. As the organization is based in India, potential data breach processes may be evaluated within the framework of local data protection regulations.

LockBit is a ransomware group that has been tracked since 2019. It has been observed to be active again following an international operation in February 2024. Organizations in the pharmaceutical and high-tech sectors often implement defensive measures such as network segmentation, strict access controls, and continuous monitoring to mitigate these types of threats. However, the persistence of groups like LockBit3 demonstrates the evolving nature of the cyber threat landscape.