Lockbit3 claims to have stolen data from bucher-strauss.ch

• Ransomware group: Lockbit3
• Country: Switzerland
• Sector: Professional Services
• Announcement date: February 18, 2024

Lockbit3 lists alleged data breach of bucher-strauss.ch

The LockBit ransomware group has listed data allegedly belonging to bucher-strauss.ch on their leak site. According to the announcement, the group claims to have gained access to information belonging to the organization and has published a listing to exert pressure for a ransom payment. The claim was made on February 18, 2024, following an alleged attack date of February 7, 2024.

Details of the alleged theft

The LockBit group claims to have obtained approximately 140 GB of data from the institution's servers. This dataset is reported to consist of 80,625 files. To increase pressure on the target, the group has set a deadline for the publication of this data on their platform.

The screenshots provided in the leak site listing display various sensitive contents. The data allegedly includes:

• Patient health records
• Medical test results
• Corporate documents

The presence of such information in the leak suggests that the stolen data contains laboratory result reports, patient information, and medical test data.

About bucher-strauss.ch

Bucher + Strauss is a law firm based in Switzerland. The company primarily provides legal consulting services in the fields of commercial law, contract law, and dispute resolution.

Potential impact and security implications

The alleged breach may compromise the privacy of the institution's patients and could lead to legal consequences under the Swiss Federal Act on Data Protection (FADP). The presence of medical reports in the leaked data may increase the risk of identity theft and targeted phishing attacks against the affected individuals.

LockBit is a ransomware actor that has been active since 2019. The group has continued its operations despite infrastructure disruptions by international law enforcement in February 2024. This persistence is a common trait among sophisticated ransomware groups that utilize double extortion tactics. In such scenarios, attackers not only encrypt an organization's data but also threaten to leak sensitive information on public forums to maximize leverage during negotiations.

For organizations in the professional services sector, particularly those handling sensitive client and medical information, such incidents highlight the necessity of robust cybersecurity frameworks. Organizations facing such threats may be required to fulfill data breach notification obligations and inform the affected parties. Defensive strategies typically involve implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to mitigate the risk of unauthorized access and subsequent data exfiltration.