Lockbit3 claims data leak involving doublehorse.in

• Ransomware group: Lockbit3
• Country: India
• Sector: Agriculture and Food Production
• Announcement date: May 9, 2024

The LockBit ransomware group has officially listed the organization doublehorse.in on its dedicated leak site. According to the announcement made on May 9, 2024, the threat actor group claims to have successfully compromised the organization's data, marking a potential significant security incident for the entity.

Details of the claimed attack

The claim made by the LockBit group suggests that the breach occurred prior to the public announcement. While the group posted the listing on May 9, 2024, the group alleges that the actual attack took place on April 24, 2024. In their public listing, the group has provided various images of documents as evidence to support their claim that they have gained access to the organization's internal files.

Ransomware groups often utilize these leak sites as a method of double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data publicly, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This tactic increases the pressure on organizations, as the consequences of a data leak can include significant reputational damage and legal liabilities.

Data and documentation involved

The evidence provided by the LockBit group in their listing includes screenshots of various documents that appear to be related to the organization's internal operations. These visual proofs suggest that the leaked content contains sensitive administrative and corporate information.

Based on the visible screenshots, the types of information potentially exposed include:

• Vehicle registration information
• Corporate administrative documents

The presence of such documents suggests that the breach may involve more than just digital files, potentially impacting the organization's physical asset management and corporate governance records. No specific information was provided regarding the total size of the data stolen or the specific number of files compromised. Additionally, no ransom demand has been publicly disclosed by the group in the current listing.

The organization and its operational risks

The target of this alleged attack is doublehorse.in, an organization operating within India. The organization is involved in the agriculture and food production sector. For an entity operating in this sector, the exposure of operational data can lead to various secondary risks, particularly for its supply chain partners and customers who may also be impacted by the breach.

The potential impact of this leak is multifaceted. The exposure of operational data, employee information, or asset details can lead to significant risks. For an organization operating in India, such a breach may trigger legal processes under local data protection regulations. Furthermore, given the historical methods employed by the LockBit group, there is a risk that the stolen data could be utilized for malicious purposes, such as identity theft or highly targeted phishing attacks against the organization or its stakeholders.

Threat actor profile and defensive considerations

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. It is important to note that while an international operation disrupted the group's infrastructure in February 2024, reports indicate that the group has since resumed its operations. This resilience highlights the ongoing threat posed by sophisticated RaaS models.

To defend against such threats, organizations in the agriculture and food production sectors should consider several defensive strategies. Implementing robust multi-factor authentication (MFA) across all remote access points is a fundamental step in preventing unauthorized entry. Additionally, maintaining strict network segmentation can help contain an attack and prevent lateral movement by an intruder. Regular, offline backups of critical data are essential for recovery in the event of a successful encryption attack. Finally, organizations should maintain a comprehensive incident response plan and ensure that they are aware of the local regulatory requirements regarding data breach notifications to mitigate legal and reputational consequences.