Lockbit3 ransomware group lists fdf.org.uk on its leak site

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Agriculture and Food Production
• Announcement date: September 28, 2023

The Food and Drink Federation (FDF), a prominent membership organization based in the United Kingdom, has been listed on the leak site of the LockBit3 ransomware group. On September 28, 2023, the threat actors behind LockBit3 published an announcement claiming to have successfully compromised the systems of fdf.org.uk. This announcement marks a significant development in the ongoing threat landscape facing the UK food and drink sector.

The claimed attack and event details

According to the announcement published by the LockBit group on September 28, 2023, the threat actors claim to have gained unauthorized access to the systems belonging to fdf.org.uk. The group asserts that various types of private data were downloaded from the organization's infrastructure during the intrusion. The threat actor's post included a countdown timer, a common tactic used by ransomware groups to pressure victims by setting a specific deadline for the public release of the allegedly stolen information.

Ransomware leak sites are often used by cybercriminals as a platform for double extortion. In this model, attackers not only encrypt an organization's data to disrupt operations but also threaten to leak sensitive information on public forums to increase pressure for ransom payments. While the specific details regarding the breach's entry point or the exact timing of the initial compromise were not provided, the public listing serves as a direct method of intimidation against the target organization.

Claimed sensitive data types

The threat actor has made specific claims regarding the nature of the information they have allegedly exfiltrated from the organization. The stolen data is said to include highly sensitive personal and corporate information that could be used for various malicious purposes. The specific categories of data mentioned in the claim include:

• Passport data
• Bank details
• Accounting records
• Legal documents
• Customer data

The presence of such diverse data types—ranging from personal identification to financial and legal documentation—suggests a broad scope of the alleged compromise. When attackers claim to have access to such a wide variety of records, it increases the potential impact on all stakeholders involved with the organization.

About the Food and Drink Federation

The Food and Drink Federation (FDF) is a membership organization that represents and provides advisory services to food and drink manufacturers in the United Kingdom. It operates to advocate for the industry's interests and provide guidance on regulatory matters. As an organization that serves as a representative body for the food and drink manufacturing sector, its operational integrity and the security of its member information are vital to the industry it supports.

Analysis and potential impact

The claims made by LockBit3 carry significant implications for the organization and its wider network. These allegations increase the risk of identity theft and fraud for the organization's employees and its members. Given the sensitive nature of the data mentioned, such an event is likely to trigger legal processes under the United Kingdom's General Data Protection Regulation (UK GDPR), which governs the processing and protection of personal data.

Furthermore, the organization's supply chain partners and members may become vulnerable to secondary attacks. In many cases, once data from a central organization is leaked, attackers use that information to launch targeted phishing campaigns against the organization's contacts, leveraging the trust established within the supply chain. Such attacks often aim to exploit the stolen customer or contact data to conduct fraudulent activities.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been active since 2019. Although its infrastructure faced significant disruption due to international law enforcement operations in February 2024, reports indicate that the group has since resumed its operations. Such leaks can have lasting negative impacts on an organization's operational credibility and its reputation among members and the public.

General defensive considerations

To mitigate the risks associated with such threats, organizations in the food and drink sector typically focus on robust security frameworks. This includes implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security awareness training for employees to prevent phishing. Additionally, maintaining comprehensive backups and ensuring data encryption can help reduce the impact of both data theft and system encryption.