Lockbit3 ransomware group lists esepac.com on its leak site

• Ransomware group: Lockbit3
• Country: France
• Sector: Education
• Announcement date: December 22, 2023

The LockBit3 ransomware group has listed the French organization esepac.com on its dedicated leak site. Through this announcement, the threat actor group claims to be in possession of various data sets belonging to the institution.

The alleged data breach event

According to the announcement made on December 22, 2023, the LockBit3 group has targeted esepac.com. The group claims to have successfully obtained a variety of personal and professional data belonging to the institution. The details provided in the leak site announcement suggest that the information exposed is related to the institution's ongoing educational activities.

Ransomware attacks involving data leaks often follow a double extortion model. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information. The threat of releasing this stolen data on a public leak site is then used as leverage to pressure the victim into paying a ransom. While the specific details regarding the ransom demand and the total volume of stolen files remain unknown, the listing itself serves as a public claim of a successful breach.

The types of data involved

The sample data provided by the group in their announcement includes several categories of sensitive information. The leaked data is said to contain details that could be used for various malicious purposes. The specific types of information identified in the listing include:

• Full names
• Job titles
• Business and personal email addresses
• Phone numbers
• Location data

The exposure of such a diverse range of information, spanning both professional and personal contexts, significantly increases the risk profile for the individuals involved. When personal identifiers like names and phone numbers are combined with email addresses and job titles, it creates a comprehensive dataset that can be exploited by cybercriminals.

About esepac.com

Esepac is an educational institution that has been operating since 1991. The organization specializes in providing training in the field of packaging engineering. The primary mission of the institution is to focus on training qualified engineers who are prepared to meet the specific technical and professional expectations of the industrial sector.

Impact and industry implications

The alleged leak of data from esepac.com carries significant risks for the institution's employees and other associated individuals. The exposure of personal and professional details increases the likelihood of identity theft and makes these individuals targets for highly specific, targeted phishing attacks. Furthermore, because the institution is based in France, this incident could lead to complex compliance issues regarding the European Union's General Data Protection Regulation (GDPR), which governs how personal data must be protected and handled.

The LockBit3 group is a known ransomware actor that has been active since 2019. Although their infrastructure faced a major disruption in February 2024, the group may continue to conduct operations. This incident highlights the ongoing threat posed by such actors to the education sector. The exposure of institutional data can negatively impact privacy standards within educational environments and may facilitate secondary attacks against the organization or its partners.

To mitigate these risks, organizations in the education sector can implement various defensive measures. Strengthening technical controls, such as multi-factor authentication and robust encryption for data at rest and in transit, is a fundamental step. Additionally, maintaining rigorous patch management and conducting regular security awareness training can help reduce the attack surface. Organizations should also focus on data minimization strategies to ensure that only necessary information is collected and stored, thereby reducing the potential impact of a future breach.