Lockbit3 ransomware group lists exco.fr on its leak site

• Ransomware group: Lockbit3
• Country: France
• Sector: Professional Services
• Announcement date: October 31, 2022

LockBit claims data breach at exco.fr

The LockBit ransomware group has listed the French organization exco.fr on its dedicated leak site. The group has made a claim regarding a data breach involving the company, asserting that they have successfully gained unauthorized access to the organization's network and have obtained data from the system.

This announcement was made on October 31, 2022. In such cyberattack scenarios, ransomware groups often utilize leak sites to pressure victims into paying ransoms. These sites serve as a public platform where threat actors post information about their targets, often employing a double extortion tactic. In a double extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information, threatening to release it publicly if the ransom is not met. This increases the pressure on the victim by threatening reputational damage and regulatory scrutiny.

Details regarding the claimed data

While the LockBit group has claimed to have accessed the network and obtained data, specific details regarding the breach remain limited. At this time, there is no information or screenshot available regarding the nature of the data shared on the leak site. The listing does not specify the volume of data stolen or the exact types of files that were compromised during the alleged intrusion.

Affected data types

• The listing names no specific data types.

About exco.fr

Exco is a France-based network of accounting, auditing, and consulting firms. The company provides professional services to businesses in various areas, including financial management, tax advisory, and corporate strategy.

Risk assessment and industry implications

This incident poses a significant risk that the organization's data may have been compromised. Depending on the actual content of the leaked data, secondary risks may emerge, such as identity theft or targeted phishing attacks directed at the organization's employees and customers. Because the organization is based in France, the incident may trigger legal considerations regarding data breach notification obligations and administrative sanctions under the General Data Protection Regulation (GDPR).

The threat actor involved, LockBit, is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Although its infrastructure was disrupted by an international operation in February 2024, it has been reported that the group has resumed its operations. This persistence makes such groups a continuous threat to various sectors.

Furthermore, because Exco operates within the professional services sector, this incident highlights an additional risk factor regarding supply chain attacks. Organizations in professional services often handle sensitive financial and strategic information for many clients, making them high-value targets. A compromise in such an organization can potentially impact the security of their entire client base. To defend against such threats, organizations typically implement defensive measures such as multi-factor authentication, regular security audits, and robust network segmentation to limit the lateral movement of attackers.