Lockbit3 ransomware group lists eagersautomotive.com.au on its leak site

• Ransomware group: Lockbit3
• Country: Australia
• Sector: Retail & E-Commerce
• Announcement date: December 30, 2023

Lockbit3 claims attack on Eagers Automotive

The Lockbit3 ransomware group has officially listed the domain eagersautomotive.com.au on its dedicated leak site. According to the announcement made on December 30, 2023, the threat actor group claims to have successfully conducted a cyberattack against the institution's systems. This development follows a claimed attack date of December 23, 2023, suggesting the intrusion occurred prior to the public announcement on the leak site.

Ransomware leak sites serve as a public platform where cybercriminals post information about their victims to pressure them into paying ransoms. This practice is a core component of modern ransomware operations. The group has established a specific timeline regarding the incident, stating that a deadline of January 19, 2024, has been set for the publication of the institution's data. If the deadline is not met, the group typically proceeds with leaking the stolen information to the public or selling it to other malicious actors.

Details regarding the alleged data breach

At this time, there is no specific information regarding the nature of the leaked data provided in the available records or screenshots. The listing does not specify the volume of files involved or the total size of the data allegedly exfiltrated from the organization's network. Furthermore, no ransom demand has been publicly disclosed in the current announcement.

The listing names no data types.

About Eagers Automotive Limited

Eagers Automotive Limited is a prominent automotive retail group with a significant presence in the Australian and New Zealand markets. Boasting a history of over 110 years, the company is a leading player in the sector, providing a comprehensive range of vehicle sales and after-sales services across a diverse portfolio of brands.

Risk assessment and potential consequences

This incident represents a significant threat that may lead to disruptions in the institution's operational processes and a substantial loss of reputation. The use of double extortion by the Lockbit group—a tactic where attackers not only encrypt data but also threaten to leak it—significantly increases the risk of sensitive information being published or sold on the dark web.

If the allegedly leaked data includes sensitive information belonging to customers or employees, the organization may face legal obligations under Australia's Privacy Act 1988. Beyond the immediate legal and operational challenges, secondary risks may emerge for the institution's customers, such as the threat of identity theft and the possibility of being targeted by sophisticated phishing attacks.

The Lockbit group is a known Ransomware-as-a-Service (RaaS) operation that has been tracked since 2019. While its infrastructure was previously disrupted during an international law enforcement operation in February 2024, reports indicate that the group has since resumed its operations. Organizations operating in the retail and automotive sectors should remain vigilant, as these entities often handle vast amounts of personal and financial data, making them attractive targets for such sophisticated threat actors.

General defensive considerations

To mitigate the risks associated with ransomware and data exfiltration, organizations typically focus on robust security frameworks. This includes implementing multi-factor authentication, maintaining rigorous patch management protocols, and ensuring comprehensive data backups are stored offline or in immutable environments. Continuous monitoring of network traffic can also help in detecting unauthorized data movement before a full-scale breach occurs.