Lockbit3 ransomware group lists aei.cc on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Announcement date: November 10, 2023

Lockbit3 claims to have exfiltrated data from American Engineers, Inc.

The LockBit ransomware group has listed American Engineers, Inc. (aei.cc) on its dedicated leak site, claiming to have successfully exfiltrated data from the organization's systems. The announcement, which appeared on November 10, 2023, suggests that the threat actors gained unauthorized access to the company's internal environment. According to the claims made by the group, the breach involves a variety of sensitive documents and personal information belonging to the firm and its specialists.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a method known as double extortion. In this scenario, attackers do not only encrypt the victim's data but also steal it, threatening to publish it publicly if their demands are not met. This tactic significantly increases the pressure on organizations, as the exposure of confidential information can lead to severe reputational and legal consequences.

Details of the alleged breach

The threat actor alleges that they gained access to the organization's systems and obtained a range of sensitive materials. According to the post made by the LockBit group, the stolen information includes urban project contracts and various forms of personal data. To demonstrate the validity of their claims, the group initiated a countdown timer in their announcement, indicating that the stolen data would be published if their conditions were not met.

The group provided screenshots as evidence of the breach. These samples reportedly include various types of sensitive documentation, such as employee employment records, educational history, and financial documents. The presence of such data suggests that the attackers were able to access internal administrative and project-related files.

Data types involved in the claim

Based on the information provided by the threat actor, the following types of data are claimed to have been accessed:

• Urban project contracts
• Employee employment records
• Educational history
• Financial documents
• Personal data

No information was provided regarding the total size of the data exfiltrated or the specific amount of files stolen. Furthermore, the group has not disclosed a specific ransom demand in the public announcement.

About American Engineers, Inc.

American Engineers, Inc. is a full-service civil engineering firm with over 35 years of experience. The company operates offices in Kentucky and Georgia. The organization specializes in the design and construction of urban infrastructure projects.

Impact and potential consequences

The claims made by LockBit, a Ransomware-as-a-Service (RaaS) group that has been active since 2019, highlight several significant risks. For an organization like American Engineers, Inc., the exposure of corporate data and project contracts could create negative impacts regarding commercial competition and intellectual property. The loss of sensitive project details may compromise the firm's competitive edge in the civil engineering sector.

Furthermore, the breach poses a direct threat to the individuals involved. The exposure of personal information, employment records, and financial documents increases the risk of identity theft and targeted phishing attacks for the organization's employees. Such attacks often leverage stolen personal details to gain further access to corporate systems or to defraud individuals directly.

As a United States-based entity, the incident may lead to legal consequences under relevant state laws and data protection standards. Organizations facing such threats are generally advised to implement robust defensive measures, such as multi-factor authentication, regular security awareness training, and comprehensive data encryption, to mitigate the impact of potential breaches. Given the history of the LockBit group, it is possible that the exfiltrated data may be utilized for secondary extortion attempts in the future.