Lockbit3 ransomware group lists cpstate.org on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Government & Defense
• Announcement date: October 16, 2023

The LockBit3 ransomware group has claimed responsibility for a cyberattack targeting the Cerebral Palsy Associations of New York State (cpstate.org). By listing the organization on its dedicated leak site, the threat actor group has signaled a significant security incident involving the non-profit entity.

The details of the claim

According to the announcement made on October 16, 2023, the LockBit3 group has officially listed cpstate.org on their leak site. The group claims to have successfully compromised the organization's data and has threatened to publish the stolen information if their demands are not met. The group has reportedly set a specific deadline for the organization to comply with their terms.

The attack is reported to have occurred on October 16, 2023, coinciding with the public announcement. This type of activity is characteristic of modern ransomware operations, where attackers use the threat of public exposure to exert maximum pressure on a victim. This tactic is often referred to as double extortion, a method where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage for ransom payments.

Data involved in the incident

At this stage, the group has not provided detailed information regarding the specific nature or the exact types of data that have been compromised. While the group has claimed that it will eventually publish file lists and samples to prove the validity of the breach, no specific data categories have been identified in the current listing.

About Cerebral Palsy Associations of New York State

Cerebral Palsy Associations of New York State (CP State) is a broad-based non-profit organization that provides services and programs for individuals with cerebral palsy and other developmental disabilities through nearly 30 affiliates. It operates across New York State, offering a wide range of support services to the community.

Risk assessment and industry implications

This incident may pose a high risk due to the organization's extensive service network and its handling of sensitive individual data. The potential publication of leaked data could lead to severe privacy violations and secondary risks, such as identity theft, for the individuals served by the organization. Because the organization is based in the United States, the breach may attract legal and administrative sanctions under strict regulations such as the Health Insurance Portability and Accountability Act (HIPAA).

The LockBit group is a known Ransomware-as-a-Service (RaaS) entity that has been active since 2019. Although the group's infrastructure was disrupted in February 2024, reports indicate that they have since resumed operations. This resilience highlights the ongoing threat posed by professionalized ransomware groups.

For organizations operating within the government and defense or non-profit sectors, such incidents underscore the necessity of robust defensive postures. Common defensive steps for organizations include maintaining rigorous backup protocols, implementing multi-factor authentication, and conducting regular security audits to protect sensitive stakeholder information. Protecting against double extortion requires a multi-layered approach to both network security and data loss prevention to ensure that even if a perimeter is breached, the sensitive data remains encrypted and unusable to unauthorized parties.