Lockbit3 claims to have stolen data from tmt-mc.jp

• Ransomware group: Lockbit3
• Country: Japan
• Sector: Professional Services
• Announcement date: March 27, 2024

The LockBit3 ransomware group has officially listed the Japanese organization tmt-mc.jp on its leak site. According to the group's announcement, which was made on March 27, 2024, the threat actors claim to have successfully exfiltrated 300 GB of confidential data from the company's networks.

The alleged breach and group claims

The LockBit group alleges that it successfully compromised the networks belonging to tmt-mc.jp. According to the claims made by the group, the breach occurred on March 27, 2024. The announcement provided by the attackers includes various details regarding the organization's operational information and its various websites.

In many modern ransomware attacks, groups employ a strategy known as double extortion. In this model, attackers do not merely encrypt a victim's files to demand a ransom for decryption; they also steal sensitive information beforehand. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying the ransom. This method increases the pressure on organizations, as the exposure of data can lead to significant reputational and legal consequences.

Details of the alleged data exfiltration

The information claimed to be stolen by the LockBit3 group is substantial in volume, totaling 300 GB. The group asserts that the stolen content includes highly sensitive corporate and technical information. Based on the screenshots provided by the attackers, the data appears to include technical schematics and various file directories.

The specific types of data mentioned in the claim include:

• Technical drawings
• Customer data

The exposure of such specific datasets, particularly technical drawings, can be devastating for companies involved in specialized manufacturing, as it potentially reveals proprietary processes and designs.

About tmt-mc.jp

TMT Machinery is a company based in Japan that operates within the professional services sector. The organization specializes in the design, development, and manufacture of textile machinery and equipment specifically intended for synthetic fiber production. Furthermore, the company is known for its expertise in high-performance yarn processing technologies.

Analysis and potential impact

This alleged breach poses significant risks to the organization, particularly regarding its intellectual property and trade secrets. The potential exposure of technical drawings and schematics could undermine the company's competitive advantage in the textile machinery market. Additionally, the exposure of customer data could lead to legal liabilities for the organization under Japanese data protection regulations.

The implications of such a leak extend beyond the immediate victim. The exfiltrated data might be utilized by the attackers in secondary attacks or for identity theft attempts. Furthermore, the organization's supply chain partners may also be indirectly affected by this breach. For companies in the manufacturing and professional services sectors, protecting the integrity of technical documentation and customer databases is a critical defensive priority.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is notable that the group is reported to have resumed its operations following an international disruption that occurred in February 2024. Such groups often target specialized industrial companies to maximize the impact of their extortion attempts. To defend against such threats, organizations typically implement multi-layered security strategies, including robust network monitoring, strict access controls, and regular security audits to detect unauthorized exfiltration attempts.