Lockbit3 ransomware group lists cdwg.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Technology
• Announcement date: September 4, 2023

LockBit3 claims attack on CDW Corporation

The LockBit3 ransomware group has listed the domain cdwg.com on its dedicated leak platform. According to the announcement, the group claims it will publish the institution's data and has initiated a countdown process. This announcement was updated on September 4, 2023.

Ransomware groups often utilize leak sites to exert pressure on their targets through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also threaten to release sensitive information on public forums if a ransom is not paid. This method aims to maximize leverage by threatening the target's reputation and legal standing through the exposure of private data.

Details of the claimed breach

Regarding the specific nature of the incident, the listing provides limited details. There is no specific information regarding the nature of the leaked or threatened data in the record or the screenshot. The announcement does not specify the volume of data involved or the number of files that have been targeted by the group.

The listing names no data types.

About CDW Corporation

CDW Corporation is a leading multi-brand provider of information technology solutions for business, government, education, and healthcare organizations. The company operates in the United States, the United Kingdom, and Canada.

Analysis and potential impact

This announcement by the LockBit group may pose a risk to the institution's data security processes. If the data is published, secondary risks such as identity theft or targeted phishing attacks may emerge for the institution's customers and employees. Furthermore, the organization may face legal processes under data protection regulations such as GDPR or CCPA in the regions where it operates, including the United States, the United Kingdom, and Canada.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. While its infrastructure was disrupted by an international operation in February 2024, it has been reported to have resumed operations afterward. The severity of the announcement may create pressure on the institution's operational continuity, considering the group's past data leak methods.

For organizations operating in the technology sector, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular vulnerability assessments to mitigate the risk of unauthorized access. When a breach is claimed, organizations typically focus on incident response protocols to contain the threat and assess the potential impact on their operational continuity and data integrity.