Lockbit3 ransomware group lists birdair.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Manufacturing
• Announcement date: June 6, 2023

The LockBit3 ransomware group has listed the organization birdair.com on its dedicated leak site, alleging that the company has been the victim of a data breach. This announcement, made on June 6, 2023, marks a new claim by the threat actor group against the US-based manufacturing firm.

Details of the alleged attack

According to the claims made by the LockBit3 group, the organization was targeted in a ransomware attack on June 6, 2023. The group has published a list of directories and files that they claim belong to the internal servers of the organization. This method of listing a victim on a leak site is a common tactic used by ransomware groups to exert pressure on their targets.

LockBit is a well-known ransomware group that has been tracked by security researchers since 2019. While international operations in February 2024 resulted in the disruption of the group's infrastructure, reports indicate that the group has since resumed its operations. The group is known for employing a double extortion method, where they not only encrypt an organization's data but also threaten to leak sensitive information to increase the pressure on the victim to pay the ransom.

Data allegedly involved in the breach

The information released by the group includes screenshots that purportedly show a list of directories from the organization's internal servers. Additionally, the group has provided a sample document titled 'Sales Record' to support their claims of unauthorized access to sensitive information.

The specific types of data allegedly compromised include:

• Sales records
• Corporate directory data

About birdair.com

Birdair is a leading specialty contractor for custom tensile fabric structures worldwide. With over 65 years of experience, the company collaborates with architects and engineers to design and construct custom tensile structures.

Risk assessment and industry implications

This alleged breach indicates that the organization may face the risk of exposure of its trade secrets and operational data. Because the organization is based in the United States, a confirmed breach could lead to legal obligations under state-level data protection laws and sectoral regulations. The exposure of such data can have cascading effects on the security of the organization's entire ecosystem.

The leaked information may be utilized by malicious actors to conduct targeted phishing attacks against employees and business partners. Such attacks often leverage specific details found in corporate directories to appear more legitimate and increase the success rate of the social engineering attempt. Furthermore, leaks of this nature can weaken the organization's supply chain security, potentially leading to secondary risks for partners and clients who interact with the company.

In the manufacturing sector, protecting operational data and trade secrets is critical for maintaining a competitive advantage. Organizations in this sector often focus on implementing robust defensive measures, such as multi-factor authentication, regular security awareness training for staff, and rigorous monitoring of network traffic to detect unauthorized access early. Protecting the supply chain is also a vital component of modern cybersecurity, as attackers often target smaller partners to gain access to larger, more secure organizations.