Lockbit3 claims data breach involving garage-cretot.fr

• Ransomware group: Lockbit3
• Country: France
• Sector: Professional Services
• Announcement date: May 9, 2024

The LockBit3 ransomware group has officially listed the French professional services organization garage-cretot.fr on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully breached the organization's systems and exfiltrated various files, which have subsequently been published as part of their extortion tactics.

Details of the alleged attack

The incident was announced on the group's leak site on May 9, 2024. The threat actors claim that the unauthorized access to the organization's systems occurred on April 30, 2024. As part of their public announcement, the group has shared sample files that they purport to be related to the internal operations of the organization.

In modern cyberattack landscapes, ransomware groups often employ a strategy known as double extortion. In this method, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. By threatening to release this stolen data on public leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This approach increases the leverage held by the cybercriminals, as the threat of reputational damage and regulatory scrutiny often outweighs the immediate cost of system downtime.

Scope of the compromised data

While the specific volume of data and the exact number of files stolen have not been disclosed by the group, the screenshots provided in the announcement offer a glimpse into the nature of the compromised information. The evidence provided by the attackers suggests that the breach may have involved highly sensitive documentation related to the organization's internal administration and client interactions.

The following types of information are indicated to have been compromised:

• Employee salary information
• Invoices
• Personal data

The exposure of such data types poses significant risks to the individuals involved. When personal information and financial records are leaked, it can lead to secondary extortion attempts, where attackers target the victims directly using the stolen information.

Organizational impact and risks

The alleged compromise of sensitive information belonging to both employees and customers significantly increases the risk of identity theft and targeted phishing attacks against the affected individuals. Because the data includes salary details and personal information, attackers can craft highly convincing social engineering campaigns to further exploit the victims.

Furthermore, because the organization operates within France, this incident may trigger specific legal obligations. Under the European Union's General Data Protection Regulation (GDPR), organizations are often required to notify regulatory authorities and affected individuals in the event of a data breach that poses a risk to their rights and freedoms. Failure to comply with these notification requirements can lead to substantial regulatory penalties.

The LockBit group is a known ransomware syndicate that has been active since 2019. Despite facing international law enforcement operations in February 2024, the group has reportedly reorganized and continues to conduct operations. This incident highlights the persistent threat posed by such organized groups, which can cause significant operational disruptions and long-term reputational damage to their targets.

Defensive considerations for professional services

For organizations operating in the professional services sector, maintaining robust cybersecurity posture is critical to protecting client trust and operational continuity. To mitigate the risks associated with data exfiltration and ransomware, organizations typically focus on several defensive layers. Implementing strong access controls and multi-factor authentication can help prevent unauthorized access to sensitive systems. Additionally, regular monitoring of network traffic can assist in detecting the lateral movement and large-scale data transfers often associated with exfiltration.

Regularly updating and patching software is another essential step in reducing the attack surface available to threat actors. Furthermore, maintaining offline, immutable backups ensures that an organization can recover its systems in the event of a successful encryption attack, though this does not prevent the risk of data exposure. As seen in this case, the primary risk shifts from system availability to data confidentiality once a breach has occurred, necessitating a strong incident response plan that includes legal and communication strategies for handling data leaks.