Lockbit3 claims data breach at iitm.ac.in

• Ransomware group: Lockbit3
• Country: India
• Sector: Education
• Announcement date: May 9, 2024

LockBit3 claims to have published data belonging to iitm.ac.in

The LockBit3 ransomware group has officially listed the domain iitm.ac.in on its dedicated leak site. According to the announcement made on May 9, 2024, the threat actor group alleges that they have successfully compromised the systems of the institution and exfiltrated sensitive information. This claim follows an alleged attack date of May 3, 2024.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this information publicly, the attackers aim to pressure the victim into paying a ransom. While the group has provided evidence to support their claims, the incident remains an allegation by the threat actor.

Details of the alleged breach

The LockBit3 group has provided certain evidence to support their claim of a successful compromise. As part of the announcement on their leak site, various screenshots were shared. These visual proofs are intended to demonstrate that the group has gained access to the internal environment of the target organization.

The content of these screenshots reportedly includes various file directory listings, which provide a glimpse into the structure of the compromised systems. Furthermore, the leaked imagery is said to display various sensitive documents, including academic documents and student admission letters. The presence of such files suggests that the breach has touched upon core administrative and academic functions of the institution.

Affected data types

• Academic documents
• Student personal information

Risk assessment and implications

This incident poses a significant risk regarding the exposure of sensitive data belonging to both students and personnel within the institution. The nature of the leaked information, specifically student admission letters and academic documents, suggests that the data could be exploited for malicious purposes. For example, stolen personal information is frequently utilized by threat actors to conduct identity theft or to launch highly targeted phishing attacks against individuals.

In the education sector, such breaches can have far-reaching consequences. Beyond the immediate privacy concerns for students and staff, a successful data leak can cause lasting damage to an institution's reputation. Additionally, such incidents may trigger legal processes and regulatory scrutiny under local data protection regulations. There is also a secondary risk that the leaked data, once available in the public domain, may be harvested and exploited by other independent threat actors.

LockBit3 is a known Ransomware-as-a-Service (RaaS) entity that has been tracked by security researchers since 2019. It is notable that the group has continued its operations despite international law enforcement actions taken against them in February 2024. This persistence highlights the ongoing challenge posed by RaaS models, where specialized developers provide malware to affiliates to carry out attacks.

To mitigate such risks, organizations in the education sector typically focus on robust defensive strategies. These include implementing multi-factor authentication (MFA) across all systems, maintaining strict network segmentation to prevent lateral movement by attackers, and conducting regular security awareness training for students and faculty. Furthermore, maintaining comprehensive backups and ensuring they are isolated from the primary network can help mitigate the impact of the encryption phase of a ransomware attack.