Lockbit3 ransomware group lists berg-life.com on its leak site

• Ransomware group: Lockbit3
• Country: Tunisia
• Sector: Manufacturing
• Announcement date: July 18, 2023

LockBit claims data breach at Berg Life

The LockBit ransomware group has listed the Tunisian-based pharmaceutical manufacturer berg-life.com on its dedicated leak site. According to the announcement made by the group, the organization's data has been compromised. The threat actor group has posted an announcement on their platform that specifically references the institution's specialized operations in the manufacturing of aerosol drugs.

The announcement provided by the group includes a visible countdown timer, indicating a scheduled time for the public release of the institution's data. This tactic is a common feature of ransomware leak sites, used to exert pressure on the targeted organization. While the group claims to have successfully compromised the entity, the breach itself remains a claim made by the ransomware group.

Data types involved in the claim

Based on the information provided by the threat actor, the breach involves various types of sensitive information. The group has provided screenshots as evidence of the compromise. These screenshots contain descriptions of the institution's business operations, alongside samples of files that appear to contain sensitive documentation. The specific types of data identified in the claim include:

• Personal data
• Corporate documents

No specific information was provided regarding the total size of the data stolen or the total number of files involved. Additionally, no ransom demand has been disclosed in the current listing.

About Berg Life

Berg Life is a pharmaceutical manufacturer located in Tunisia. The organization specializes in aerosol drug technologies. It is recognized as one of the key laboratories within the Africa and Middle East regions that has mastered the use of environmentally friendly HFA propellant technology.

Analysis and industry implications

LockBit is a ransomware group that has been tracked by security researchers since 2019. Despite facing infrastructure disruptions in February 2024, the group has continued its operations. This specific incident highlights the ongoing threat posed by such groups, which often employ a double-extortion method. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, aiming to cause reputational damage and operational disruption.

Given that the institution operates within the pharmaceutical sector, the leaked data may pose significant risks regarding intellectual property and trade secrets. The exposure of such information can undermine a company's competitive advantage and research investments. Furthermore, the presence of personal data in the leaked files could lead to identity theft and targeted phishing attacks against employees or third parties. Such incidents may also lead to legal liabilities for the institution under Tunisian data protection regulations.

For organizations operating in highly regulated sectors like pharmaceuticals, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits. Protecting intellectual property and sensitive personal information is critical to preventing the long-term reputational and legal consequences that follow a data leak.