Lockbit3 ransomware group lists dywidag.com on its leak site

• Ransomware group: Lockbit3
• Country: Germany
• Sector: Professional Services
• Announcement date: January 19, 2024

The Lockbit3 ransomware group has listed dywidag.com on its dedicated leak site, claiming that the organization has been the target of a cyberattack. This announcement, made on January 19, 2024, marks a significant development in the ongoing activity of the threat actor group, which has been observed since 2019 and is known for its ability to restructure despite international law enforcement operations.

The details of the claim

According to the announcement posted on the group's leak portal, the Lockbit3 group added the dywidag.com domain to its list of victims on January 19, 2024. The group has initiated a countdown timer on their platform, a common tactic used in double extortion schemes. This countdown indicates the group's stated intention to publish the institution's data if their demands are not met. This listing serves as the group's formal claim of having successfully conducted a cyberattack against the organization.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. In many modern ransomware campaigns, groups employ a strategy known as double extortion. In this scenario, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data. The threat of releasing this stolen information publicly or selling it on dark web forums provides the attackers with additional leverage to compel payment.

Data involved in the incident

At this stage of the incident, the group has not provided any specific details or sample files regarding the nature of the allegedly leaked data. No information has been released concerning the volume of data or the specific types of files that may have been compromised during the alleged attack.

• No specific data types or files have been identified in the listing.

About dywidag.com

DYWIDAG is an international construction and engineering company that provides infrastructure projects, bridges, tunnels, and specialized engineering solutions globally. The company specializes in post-tensioning technologies and complex structural engineering.

Potential implications and risks

This claim poses a potential threat to the institution's operational continuity and data privacy. Because the organization is based in Germany, a successful breach could lead to significant legal sanctions and mandatory notification obligations under the General Data Protection Regulation (GDPR). The legal framework in the European Union requires organizations to be highly vigilant regarding data protection to avoid heavy penalties.

Given the established methods used by the Lockbit group, there is a possibility that any leaked data could be utilized in secondary attacks or in attempts at identity theft. Furthermore, the organization may face risks such as targeted phishing attacks directed at its clients and employees. Such attacks often use stolen information to appear legitimate, making them harder for individuals to detect.

For organizations in the professional services and engineering sectors, maintaining robust cybersecurity postures is essential. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, continuous monitoring of network traffic and strict access controls can help mitigate the impact of unauthorized access and data exfiltration.