Lockbit3 ransomware group lists chula.ac.th on its leak site

• Ransomware group: Lockbit3
• Country: Thailand
• Sector: Education
• Announcement date: August 9, 2023

LockBit3 claims data breach at Chulalongkorn University

The LockBit3 ransomware group has listed Chulalongkorn University on its dedicated leak site, claiming to have successfully compromised data belonging to the institution. This announcement, made on August 9, 2023, marks a potential significant security incident for the prominent Thai academic institution. The group's listing serves as a public claim of a successful intrusion and data exfiltration operation targeting the university's network.

Details of the alleged attack

According to the announcement posted by the LockBit3 group, the threat actor added the domain chula.ac.th to its leak site on August 9, 2023. Upon making the listing, the group initiated a countdown timer, a common tactic used by ransomware operators to pressure victims into meeting ransom demands by threatening the public release of stolen information. The group's post included a brief description of the institution's academic activities and provided several screenshots of files that they claim were exfiltrated from the university's internal network.

Ransomware groups often utilize these leak sites to conduct double extortion campaigns. In such scenarios, the attackers not only encrypt the victim's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish the data, the attackers aim to increase the pressure on the organization to pay a ransom to prevent the exposure of confidential information.

Alleged data types involved

The screenshots provided by the LockBit3 group as evidence of the breach suggest that various sensitive documents were accessed. The information displayed in these images reportedly includes:

• Financial documents
• Transaction records
• Identity information

The presence of such data, including an example of an identification card, suggests that the breach may have touched upon sensitive personal and administrative information held by the university.

About Chulalongkorn University

Chulalongkorn University is a prominent public research university located in Bangkok, Thailand. As one of the oldest and most prestigious higher education institutions in the country, it conducts education and research activities across various academic disciplines. Given its status and role in the higher education sector, the institution manages a vast amount of sensitive data related to its academic, research, and administrative functions.

Implications and potential risks

The alleged leak poses a significant risk of exposure for student and staff data held by the institution. The shared identity and financial documents could potentially lead to identity theft or targeted phishing attacks against the affected individuals. When personal identifiers and financial records are leaked, they become valuable assets for cybercriminals looking to conduct social engineering or fraudulent activities.

For an institution operating within the education sector, such an incident may trigger regulatory compliance processes regarding the protection of sensitive personal data. Organizations in this sector are often required to follow strict data protection frameworks to ensure the privacy of their students, faculty, and staff. Failure to secure this data can lead to both reputational damage and significant operational disruptions for the institution.

The LockBit group is a known ransomware actor that has been active since 2019. Despite an international operation against its infrastructure in February 2024, reports indicate that the group has resumed its operations. This persistence highlights the ongoing threat posed by sophisticated ransomware-as-a-service (RaaS) models. To defend against such threats, organizations typically implement defensive measures such as multi-factor authentication, regular security awareness training, robust backup strategies, and continuous monitoring of network traffic to detect unauthorized exfiltration attempts.