Lockbit3 ransomware group lists aqhch.com.cn on its leak site

• Ransomware group: Lockbit3
• Country: China
• Sector: Manufacturing
• Announcement date: April 16, 2025

LockBit claims data breach against Heng Chang Machinery Co., Ltd

The LockBit ransomware group has officially listed Heng Chang Machinery Co., Ltd on its dedicated leak site. In an announcement published on April 16, 2025, the threat actor group claimed to have successfully obtained data belonging to the organization. This development follows a claimed attack date of April 12, 2025, marking a significant escalation in the group's targeting of industrial entities.

Ransomware leak sites are a central component of modern cyber extortion tactics. These platforms are used by threat actors to exert pressure on victims by threatening to publish sensitive information if specific demands are not met. This method, often referred to as double extortion, involves both the encryption of local systems and the theft of data to ensure leverage over the target organization.

Details of the claimed incident

According to the announcement made by the LockBit group, the organization is facing a potential data leak. The group has established a deadline of April 30, 2025, for the potential release of the data they claim to have stolen. This countdown creates a high-pressure environment for the victim, as the threat of public exposure looms.

Regarding the specific nature or content of the compromised information, the announcement provides no detailed information. The listing does not specify the volume of data stolen or the exact types of files that have been accessed by the attackers.

• No specific data types were named in the listing.

About Heng Chang Machinery Co., Ltd

Heng Chang Machinery Co., Ltd (HCH) is a professional manufacturer based in China. Founded in 1988, the company has established itself as a world-class provider specializing in complete production lines for disposable hygiene products. As a significant player in the manufacturing sector, the company's operations involve complex industrial processes and specialized technical knowledge.

Analysis and potential impact

The LockBit group is a well-known threat actor operating under a Ransomware-as-a-Service (RaaS) model. While the group was subject to international operations in February 2024, it has been observed to have resumed its activities. This persistence makes them a significant threat to global organizations across various sectors.

Because Heng Chang Machinery Co., Ltd operates within the manufacturing sector, the potential leak of intellectual property and trade secrets poses significant risks to the organization. The exposure of corporate data in such an environment can lead to the disclosure of employee personal information and may negatively impact the broader supply chain. Furthermore, such incidents can disrupt operational continuity and provide a foundation for future targeted phishing attacks.

For organizations in the manufacturing sector, defending against such threats requires a multi-layered approach. Implementing robust backup solutions, ensuring regular offline backups, and maintaining strict access controls are essential defensive steps. Additionally, monitoring for unauthorized data exfiltration and conducting regular security awareness training can help mitigate the risks associated with both initial access and subsequent extortion attempts.