Lockbit3 ransomware group lists fager-mcgee.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Announcement date: December 22, 2023

Lockbit3 claims data breach at Fager-McGee Commercial Construction, Inc.

The Lockbit3 ransomware group has published data allegedly belonging to Fager-McGee Commercial Construction, Inc. on its leak site. This announcement, made on December 22, 2023, marks a new instance of the group targeting specific organizations to exert pressure through data exposure.

The group claims to have gained unauthorized access to the organization's systems, leading to the alleged theft of sensitive information. This type of activity is characteristic of modern ransomware operations, where threat actors utilize double extortion tactics. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to leak the stolen information on public leak sites to coerce the victim into paying a ransom.

Details of the alleged data leak

According to the announcement on the Lockbit3 leak site, the group has listed the domain fager-mcgee.com and claims to have made specific data accessible to the public. The post includes samples of information that the group alleges belongs to the company's operations and its employees. While the specific volume of files and the total size of the data have not been disclosed by the group, the content of the post points toward a significant exposure of personal details.

The information allegedly leaked includes various types of sensitive data belonging to the organization's workforce. The specific categories of data mentioned in the leak include:

• Employee contact information
• Employee personal data

More specifically, the content of the post reportedly includes personal details such as names, surnames, job titles, personal and business email addresses, phone numbers, and social media profiles belonging to employees.

About Fager-McGee Commercial Construction, Inc.

Fager-McGee Commercial Construction, Inc. is an Illinois-based general contracting and design-build firm. Founded in 1986, the company provides comprehensive services for commercial construction projects.

Threat actor profile and potential impact

Lockbit3 is a known threat actor that has been active since 2019. The group operates under the Ransomware-as-a-Service (RaaS) model, which allows different affiliates to use the group's infrastructure and tools to conduct attacks. It is notable that despite the group's infrastructure being disrupted by international operations in February 2024, the group has been observed to have resumed its activities.

The implications of this alleged leak are multifaceted. The stolen data, which includes employee contact information and personal details, may pose a significant risk for identity theft and targeted phishing attacks against the affected employees. When personal identifiers like email addresses and phone numbers are exposed, they become valuable assets for attackers looking to conduct highly convincing social engineering campaigns.

Furthermore, because the organization is based in the United States, this incident may trigger state-level data protection laws and potential notification obligations. Beyond the immediate impact on the company's internal data, indirect impacts on the organization's supply chain and business partners may also be observed. Organizations in the construction and contracting sectors often deal with numerous subcontractors and vendors, making the security of their data vital to the stability of their broader business ecosystem.

To mitigate such risks, organizations typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, maintaining comprehensive backups and ensuring they are isolated from the main network can help protect against the encryption phase of a ransomware attack.