Lockbit3 ransomware group lists easternshipbuilding.com on its leak site

• Ransomware group: Lockbit3
• Country: Panama
• Sector: Manufacturing
• Announcement date: February 28, 2024

Lockbit3 claims data theft against Eastern Shipbuilding Group

The Lockbit3 ransomware group has listed easternshipbuilding.com on its dedicated leak site, claiming to have successfully obtained private data belonging to the organization. This announcement, made on February 28, 2024, follows an alleged intrusion into the company's systems that reportedly occurred on February 3, 2024.

Ransomware attacks often involve a tactic known as double extortion, where threat actors not only encrypt an organization's files to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish stolen data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or sensitive information. Such leak sites serve as a public gallery for the group's victims, increasing the pressure on the targeted entities.

Details of the alleged breach

According to the announcement posted by the group, the attackers claim to have gained unauthorized access to the organization's internal systems. The group asserts that they have acquired a significant amount of private data during this breach. The listing included a deadline of March 1, 2024, for the potential publication of the stolen information, creating a high-pressure scenario for the targeted organization.

Regarding the specific contents of the breach, the announcement does not provide specific details regarding the nature of the leaked data, only referring to it as "very private and important data." The listing names no specific data types.

About Eastern Shipbuilding Group

Eastern Shipbuilding Group is a Florida-based shipbuilding company that constructs various types of vessels for commercial and government projects. Established in 1976, the company began with fishing boats and has since expanded its operations into the defense and commercial maritime sectors.

Analysis and industry implications

The Lockbit group is a Ransomware-as-a-Service (RaaS) entity that has been active since 2019. The fact that the group has resumed operations following the disruption of its infrastructure in February 2024 suggests that the threat remains persistent and resilient against law enforcement interventions.

The potential leak of the organization's data may lead to identity theft risks for employees or business partners. Furthermore, as a manufacturing entity, the exposure of trade secrets and technical documentation could negatively impact the organization's competitive position. When sensitive technical specifications or proprietary designs are compromised, it can undermine the unique market advantages that a manufacturing firm relies upon to secure contracts.

Additionally, in the event of a data breach, the organization may face legal and administrative penalties under applicable local and international data protection regulations. Organizations facing such threats often prioritize defensive steps such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access.

Summary of the incident

• Target: easternshipbuilding.com
• Threat Actor: Lockbit3
• Claimed Attack Date: February 3, 2024
• Announcement Date: February 28, 2024
• Announcement Type: Data breach claim