Lockbit3 ransomware group lists elementnor.no on its leak site

• Ransomware group: Lockbit3
• Country: Norway
• Sector: Manufacturing
• Announcement date: September 20, 2022

LockBit3 claims data breach at elementnor.no

The LockBit3 ransomware group has officially listed the domain elementnor.no on its dedicated leak site. According to the group's announcement, the organization has been targeted in a cyberattack, and the group claims to have successfully compromised data belonging to the entity. This development follows a pattern of double extortion often employed by modern ransomware operations, where threat actors not only encrypt local systems but also threaten to leak sensitive information to pressure victims into paying a ransom.

The announcement made by the group is based on an alleged attack that took place on September 20, 2022. While the listing serves as a public notification of the group's intent, the group has indicated that the relevant data may be published on their site or sold to other malicious actors on the dark web. Such threats are a hallmark of Ransomware-as-a-Service (RaaS) business models, where the primary goal is to maximize leverage through the threat of public exposure.

Details of the alleged leak

Regarding the specifics of the incident, the group has provided very limited information to the public. At this time, there is no screenshot or detailed information available regarding the nature of the alleged leaked data. The listing does not specify the volume of files involved or the total size of the data set that the group claims to possess.

Furthermore, the listing names no specific data types that have been compromised. Without a detailed inventory of the files, it remains unclear whether the breach involves intellectual property, financial records, or employee information. The lack of transparency from the threat actor is a common tactic used to maintain uncertainty and increase the psychological pressure on the victim organization.

About elementnor.no

Elementnor is a Norway-based manufacturing and industrial solutions company. The organization operates primarily in the supply and production of technical equipment and industrial components. Given its role in the manufacturing and industrial sectors, the company serves as a critical link in the supply chain for various technical applications.

Potential risks and organizational impact

The claim made by LockBit3 may pose significant risks to the organization's operational continuity. If sensitive data is indeed disclosed, the company could face substantial reputational damage. Beyond the immediate operational impact, the breach of personal data may trigger legal obligations under the General Data Protection Regulation (GDPR), potentially resulting in administrative sanctions for the organization.

Secondary risks associated with such leaks include the potential use of stolen data for identity theft or highly targeted phishing attacks against the company's employees or partners. These types of attacks often leverage the specific context of the leaked data to appear more legitimate to the recipient.

The LockBit group is a known RaaS entity that has been active since 2019. Notably, the group reportedly resumed operations after its infrastructure was disrupted in February 2024, suggesting that their methods and presence pose a persistent threat to corporate networks globally. For organizations in the manufacturing sector, maintaining robust security postures is essential to defend against such persistent threats. Common defensive strategies include implementing strict access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by sophisticated ransomware groups.