Lockbit3 ransomware group lists acdcexpress.com on its leak site

• Ransomware group: Lockbit3
• Country: South Africa
• Sector: Transportation
• Announcement date: August 11, 2024

LockBit claims attack on ACDC Express

The LockBit ransomware group has listed the South African electrical retailer ACDC Express on its dedicated leak platform. According to the announcement made by the group, an action was carried out against the systems of the organization. This listing was discovered on August 11, 2024, although the group specifies that the attack itself took place on May 11, 2024.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information on public platforms if a ransom is not met. This tactic is designed to exert maximum pressure on the victim by threatening reputational damage and legal consequences. The presence of an organization on such a site serves as a public notification of the group's claim of a successful breach.

Details regarding the alleged data breach

Despite the announcement on the leak site, there are currently no specific details or sample files provided regarding the content of the allegedly leaked data. The information currently available from the group's interface is limited to a general verification interface of the leak site. Consequently, the specific nature and volume of the data involved in this incident remain unconfirmed.

The listing names no specific data types.

Potential risks and organizational impact

The claim made by the LockBit group may pose significant risks to the operational continuity of the organization. While the exact nature of the allegedly leaked data remains unclear, the potential exposure of customer and employee information could lead to substantial reputational damage and legal sanctions. For organizations operating within South Africa, such incidents may trigger specific legal obligations under the Protection of Personal Information Act (POPIA), which may require the organization to fulfill mandatory data breach notification requirements.

Furthermore, such leaks can create secondary risks for the broader business ecosystem. The exposure of information can lead to increased risks of secondary phishing attacks targeting other stakeholders within the organization's supply chain. Maintaining robust security postures and monitoring for such threats is a common defensive step for organizations to mitigate the fallout of such breaches.

About ACDC Express

ACDC Express is a South African electrical retail and wholesale franchise chain. The company specializes in the supply of a wide range of electrical products and equipment.

Background on the threat actor

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. The group is known for its sophisticated operations and has been a prominent player in the ransomware landscape. It is reported that the group resumed its operations following an international law enforcement operation that targeted the group in February 2024.