Lockbit3 claims data breach at shoreregional.org

• Ransomware group: Lockbit3
• Country: United States
• Sector: Government & Defense
• Announcement date: May 18, 2023

Lockbit3 claims data breach at shoreregional.org

The Lockbit3 ransomware group has claimed to have compromised data belonging to shoreregional.org. The threat actor group listed the domain on its dedicated leak site, announcing its intention to publish data allegedly belonging to the institution. This announcement was made on May 18, 2023, and the group initiated a countdown timer alongside the posting.

Details of the alleged attack

The claim involves the domain shoreregional.org. Lockbit3 is recognized as a Ransomware-as-a-Service (RaaS) group that has been active since 2019. Following an international disruption operation conducted in February 2024, the group reportedly resumed its activities. In this instance, the group has utilized its leak site to pressure the organization by threatening the release of sensitive information.

Ransomware leak sites are platforms used by cybercriminals to host stolen data to exert pressure on victims. These groups often employ a method known as double extortion. In a double extortion scheme, attackers do not just encrypt an organization's files to disrupt operations; they also steal sensitive data before encryption. The threat of leaking this stolen information publicly serves as additional leverage to compel the victim to pay the ransom.

Data types involved in the claim

Based on the screenshots provided by the group, the stolen files reportedly include various sensitive documents. The data identified in the samples includes:

• Student names
• Attendance records
• Billing statements
• Various payment logs

The specific data types identified in the leak claim include:

• Student personal data
• Financial records
• Billing information

About Shore Regional Health

Shore Regional Health is a healthcare organization providing medical services in the state of Maryland. It offers medical care and health support services through a network of regional hospitals and clinics.

Impact and organizational risks

The alleged leak of data from an educational institution suggests that students and staff may be exposed to risks of identity theft. The shared samples indicate that sensitive financial and personal information may have been compromised. Because the data is linked to an institution, the publication of this information could lead to reputational damage and operational disruptions for the organization. Furthermore, secondary risks may include the potential use of the leaked data in targeted phishing campaigns.

When an organization faces such a breach, it may be required to fulfill data breach notification obligations under relevant regulations. For organizations operating within the healthcare and educational sectors, maintaining robust security postures is critical to prevent such incidents. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of phishing and unauthorized access.