Lockbit3 lists norcorp.com on leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Manufacturing
• Announcement date: May 15, 2023

LockBit3 claims data breach at norcorp.com

The LockBit ransomware group has listed norcorp.com on its leak site, claiming that data belonging to the organization will be published. This announcement, made on May 15, 2023, indicates a potential data leak involving the manufacturing firm.

Details of the claim

The LockBit group added norcorp.com to its leak platform on May 15, 2023. Following the listing, the group initiated a countdown, stating that the organization's data would be published. The announcement contains claims regarding a threat to the organization's manufacturing operations.

Ransomware groups often use these countdown timers as a psychological tactic in double extortion schemes. In such scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also threaten to release sensitive information on public leak sites to pressure the victim into paying a ransom. This method aims to maximize the impact of the attack by threatening the victim's reputation and legal standing.

Information regarding the leaked data

There is no information regarding the nature of the alleged leaked data in the provided screenshot or registration records. The listing names no specific data types.

About Northern Engraving Corporation

Founded in 1908, Northern Engraving Corporation is a leading supplier of nameplates and decorative trim for a variety of markets. The company provides value-added services including design, engineering, and program management.

Risk assessment and industry implications

The LockBit group is known as a ransomware-as-a-service (RaaS) entity active since 2019; despite an international operation against its infrastructure in February 2024, it is reported to have resumed operations. If the organization's data is published, there may be a risk of exposure for sensitive information such as trade secrets or employee data. This situation could lead to a loss of competitive advantage and operational disruptions within the organization's sector. Furthermore, it is possible that the leaked data could be utilized for secondary attacks or targeted phishing campaigns.

For organizations operating in the manufacturing sector, such incidents present significant challenges. The exposure of proprietary designs, engineering specifications, or client lists can undermine a company's competitive position in the market. Additionally, the disruption of manufacturing processes can lead to supply chain issues and failure to meet contractual obligations.

To mitigate these risks, organizations typically focus on robust defensive measures. This includes implementing strict access controls to protect intellectual property, maintaining regular offline backups to ensure operational continuity, and conducting comprehensive employee training to defend against phishing attempts. Monitoring network traffic for unusual activity and maintaining a rapid incident response plan are also critical components of a modern cybersecurity posture designed to defend against sophisticated RaaS entities.