Lockbit3 ransomware group lists aegean.gr on its leak site

• Ransomware group: Lockbit3
• Country: Greece
• Sector: Education
• Announcement date: November 12, 2023

LockBit3 claims University of the Aegean data is at risk

The University of the Aegean (aegean.gr), a prominent educational institution based in Greece, has been listed on the leak site of the LockBit3 ransomware group. The threat actors have officially announced the targeting of the domain, claiming that the institution's data is subject to imminent publication. This announcement, which was recorded on November 12, 2023, serves as a direct threat to the university, as the group has initiated a countdown process intended to pressure the organization before the alleged data is released publicly.

Ransomware leak sites function as a platform for cybercriminals to exert pressure on their victims. By listing an organization on such a portal, threat actors aim to damage the reputation of the victim and create urgency through public exposure. This tactic is a hallmark of modern cyber extortion, where the threat of data exposure is used as leverage to compel the victim to meet financial demands.

Details of the claimed attack and the threat of publication

The LockBit3 ransomware group has claimed responsibility for the incident, specifically targeting the aegean.gr domain. According to the announcement made on November 12, 2023, the group is threatening to publish the institution's data. To increase the psychological pressure on the university, the attackers have implemented a countdown mechanism, a common tactic used to create a sense of urgency and panic within the targeted organization and the public.

The nature of the leaked or threatened data remains entirely unspecified. The provided records and screenshots do not contain any information regarding the specific types of files, the volume of data, or the specific content that the group claims to possess. Consequently, it is currently unknown what specific information is being used as leverage in this threat.

The University of the Aegean profile

The University of the Aegean is a public university located in Greece. The institution maintains a significant presence across the Greek islands, with campuses situated on Lesvos, Chios, Samos, Rhodes, Syros, and Lemnos. Founded in 1984, the university serves as a major educational hub, providing a wide range of undergraduate and postgraduate education across various academic disciplines.

Implications for academic institutions and data protection

This claim against the University of the Aegean highlights the ongoing risks faced by academic institutions, where sensitive data is often stored and processed. If a data breach were to occur, the exposure of student and staff information could lead to significant secondary risks. These risks include identity theft and the execution of highly targeted phishing attacks against the members of the academic community.

Furthermore, because the institution is located within an EU member state, any confirmed data breach would trigger significant legal considerations. The organization would be subject to strict data protection obligations and potential legal sanctions under the General Data Protection Regulation (GDPR). The complexity of managing academic data across multiple campuses adds an additional layer of operational difficulty in the event of a security incident.

The tactics employed by LockBit3 in this instance appear to align with double extortion methods. In a double extortion scenario, attackers do not only encrypt an organization's systems but also steal sensitive data to use as leverage. The goal is to demand ransom not just for the decryption of files, but to prevent the public release of stolen information. To defend against such threats, organizations in the education sector typically focus on robust data encryption, strict access controls, and comprehensive monitoring to detect unauthorized data movement before it can be exfiltrated.