Lockbit3 claims to have stolen financial data from roys.co.uk

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Retail & E-Commerce
• Announcement date: July 9, 2023

LockBit3 targets roys.co.uk in alleged data breach

The LockBit3 ransomware group has officially listed the British retail organization roys.co.uk on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated sensitive information from the company and is currently threatening to publish this data online. This development highlights the ongoing threat posed by ransomware-as-a-service (RaaS) operations that utilize double extortion tactics to pressure victims.

In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release confidential files on a public leak site, the attackers aim to maximize the pressure on the victim to pay a ransom, often targeting the organization's reputation or regulatory standing.

Details of the alleged attack

The listing of roys.co.uk was added to the LockBit3 leak site on July 9, 2023. The group alleges that they have obtained critical financial documentation belonging to the company. The announcement provided by the attackers included a countdown timer, a common tactic used by ransomware groups to create a sense of urgency and psychological pressure on the target organization to meet their demands before the data is released to the public.

While the group has made these claims, the specific details regarding the exact timing of the initial intrusion or the total volume of data stolen remain unconfirmed by the source. The group's activity serves as a reminder of the persistent nature of such groups; although the infrastructure associated with LockBit was disrupted in February 2024, it has been observed that the group continues its operations despite such law enforcement interventions.

Data involved in the claim

The announcement specifies that the group is in possession of specific financial documentation. The claims focus on the following types of information:

• Financial records
• 2022 financial reports

The group asserts that these documents are currently held by them as part of their extortion attempt.

About roys.co.uk

Roys of Wroxham is a British retail company based in Norfolk. The organization operates a chain of department stores and supermarkets, providing a wide range of products to its customer base. Their inventory includes groceries, homeware, clothing, and gardening supplies.

Impact and organizational risks

The claims made by the LockBit3 group pose significant risks to the organization. If the alleged financial data is indeed leaked, it could result in severe damage to the company's commercial reputation. Furthermore, the exposure of such sensitive information could lead to complex compliance issues under United Kingdom data protection regulations.

Beyond the immediate regulatory and reputational damage, there is a significant risk that the leaked financial information could be exploited by third parties. Such data is highly valuable for malicious actors who may use it to conduct fraudulent activities or to launch highly targeted phishing attacks against the company or its stakeholders. Such attacks often use specific, stolen details to appear legitimate and deceive employees or partners.

To defend against such threats, organizations in the retail and e-commerce sectors typically focus on several defensive strategies. These include implementing robust data encryption for sensitive files, maintaining strict access controls to prevent unauthorized data exfiltration, and ensuring comprehensive logging and monitoring to detect unusual network activity. Additionally, maintaining regular, offline backups and conducting regular security audits are essential components of a modern cybersecurity posture designed to mitigate the impact of ransomware and data theft.