Lockbit3 ransomware group lists dunaway.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: February 25, 2024

Lockbit3 claims breach of dunaway.com

The Lockbit3 ransomware group has listed dunaway.com, a professional services firm, on their leak site. This announcement, appearing on the group's dedicated portal, indicates a potential data breach involving the organization.

According to the claim made by the threat actors, they gained unauthorized access to the organization's systems on January 29, 2024. The official announcement regarding this incident was published on the group's leak site on February 25, 2024. While the group has successfully identified the target, they have not provided specific details regarding the total volume of the leaked data or a specific ransom demand in their public post.

Details regarding the claimed data

At this stage of the incident, the specific content of the leaked or threatened data remains unknown. The threat actors have not shared any details regarding the content of the files involved in this claim. Furthermore, the screenshots provided by the group do not contain any specific information regarding the types of data involved in the alleged breach.

The listing names no specific data types.

About dunaway.com

Dunaway is a professional services firm that provides a wide range of specialized services. The company focuses on construction inspection, civil engineering, structural engineering, landscape architecture, and surveying services. Based in Texas, the company specializes in various urban planning and infrastructure projects.

Analysis and potential impact

This claim may pose a significant risk to the organization's operational continuity and data privacy. Because the entity is based in the United States, any potential data breaches may be subject to state-level data protection laws and industry-specific regulations. The nature of the professional services sector often involves sensitive project details and client information, making the security of such data critical for maintaining trust and regulatory compliance.

Given the past methods of the Lockbit group, it is possible that the leaked data could be used for secondary attacks or identity theft. The group has been active since 2019 and has resumed operations despite experiencing international disruptions in February 2024. This resilience highlights the ongoing threat posed by such groups to various sectors.

Furthermore, the organization's clients and employees may be exposed to targeted phishing attacks resulting from this incident. In such scenarios, organizations often face the challenge of managing the fallout of double extortion tactics, where threat actors not only encrypt data but also threaten to leak it to pressure the victim into paying a ransom. To mitigate such risks, organizations typically focus on robust defensive measures, such as maintaining offline backups, implementing multi-factor authentication, and conducting regular security awareness training to protect against phishing attempts.

Summary of the incident

• Target: dunaway.com
• Ransomware group: Lockbit3
• Claimed breach date: January 29, 2024
• Announcement date: February 25, 2024
• Location: United States
• Industry: Professional Services