Lockbit3 ransomware group lists apolloscientific.co.uk on its leak site

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: April 24, 2023

LockBit3 claims data compromise of Apollo Scientific

The LockBit ransomware group has claimed to have compromised data belonging to Apollo Scientific, a company operating in the United Kingdom. This announcement was made via the group's dedicated leak site, marking a recent development in the group's ongoing operational activities. The claim suggests that the organization's data has been targeted as part of a broader campaign by the threat actor.

Details of the alleged attack

On April 24, 2023, the LockBit group officially listed apolloscientific.co.uk on their leak site. Following the initial listing, the group initiated a countdown timer, a tactic often used by ransomware operators to pressure victims by indicating their intention to publish the institution's data publicly if demands are not met. This method is a hallmark of modern ransomware operations, specifically those employing double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage during ransom negotiations.

While the group has made these claims, the specific details regarding the nature of the attack remain limited. At this time, there is no specific information regarding the content of the leaked or threatened data. The listing does not provide details regarding the volume of data taken or the specific files that have been targeted by the attackers.

The organization involved

Apollo Scientific is a British company specializing in the manufacture and supply of aromatic, heterocyclic and aliphatic compounds, fluorochemicals, and life sciences reagents. The company provides services and expertise in the sourcing and manufacturing of both available and novel chemical products. Given its role in the manufacturing sector, particularly within the chemical and life sciences industries, the organization handles specialized technical information and supply chain data.

Risk assessment and industry implications

This incident may pose significant risks to the institution's operational continuity and commercial reputation. Depending on the nature of the alleged leaked data, the institution may face legal obligations under the UK GDPR. The potential exposure of sensitive information can lead to complex regulatory scrutiny and compliance requirements regarding data protection and privacy.

Beyond the immediate regulatory concerns, secondary risks include the potential use of leaked data for identity theft or targeted phishing attacks. When sensitive organizational or individual data is released, it often becomes a resource for other malicious actors to conduct more sophisticated social engineering campaigns.

The threat actor involved, LockBit, is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is important to note that although its infrastructure was disrupted by an international operation in February 2024, it has been reported to have resumed operations. This suggests that the group's attack capabilities may persist despite previous law enforcement interventions. For organizations in the manufacturing and chemical sectors, such persistent threats underscore the necessity of robust cybersecurity frameworks. Defensive measures typically include maintaining offline backups, implementing strict access controls, and conducting regular security audits to mitigate the impact of potential breaches.