Lockbit3 ransomware group lists everstrong.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Announcement date: November 5, 2022

LockBit claims access to everstrong.com data

The LockBit ransomware group has officially listed the domain everstrong.com on its dedicated leak site. This announcement, made on November 5, 2022, indicates that the threat actor group claims to have successfully gained unauthorized access to the organization's data. While the listing has been made public on the group's platform, the group has not provided any technical details regarding the specific methods used to execute the attack, nor has there been any information released concerning the current operational status of the organization.

Ransomware leak sites serve as a primary tool for cybercriminal groups to exert pressure on their victims. These platforms are used to host information about targeted organizations, often serving as a public notice of a successful breach. In many instances, these groups utilize these sites to demand payment in exchange for not releasing stolen data or to announce that a company has refused to comply with ransom demands.

Details regarding the claimed data breach

At this stage of the incident, the specific nature of the leaked information remains unknown. The LockBit group has not shared any screenshots or file samples that would provide insight into the types of data that may have been compromised. Consequently, there is no information available regarding the volume of data involved or the specific file counts associated with this claim.

The listing names no specific data types as being involved in the breach.

Understanding double extortion tactics

The LockBit group is known for employing double-extortion tactics. In a typical double-extortion scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption phase. This allows the attackers to threaten the public release of the stolen information on leak sites if the ransom is not paid, thereby increasing the leverage they hold over the victim organization.

About everstrong.com

Everstrong is a United States-based construction company. The organization specializes in providing various engineering services as well as managing commercial and industrial construction projects.

Potential risks and organizational implications

This incident may indicate the presence of potential vulnerabilities within the organization's data security processes. If the claims made by the LockBit group are verified, the organization could face significant secondary risks. These risks include the possibility of identity theft or the deployment of targeted phishing attacks aimed at the organization's customers and employees.

When an organization faces a data breach, several legal and administrative consequences may follow. Depending on the specific region where the organization operates, legal processes and administrative sanctions under relevant data protection regulations may be triggered. Organizations in the construction and engineering sectors often handle a variety of sensitive project details and client information, making the protection of such data critical to maintaining trust and regulatory compliance.

To mitigate such risks, organizations typically focus on strengthening their defensive posture through various security measures. This often includes implementing robust access controls, maintaining regular backups, and conducting frequent vulnerability assessments to identify and patch weaknesses before they can be exploited by threat actors.