Lockbit3 ransomware group lists fersan.com.tr on its leak site

• Ransomware group: Lockbit3
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: September 19, 2023

Lockbit3 claims to have compromised fersan.com.tr data

The Lockbit3 ransomware group has published a leak announcement on its platform, claiming to have successfully compromised data belonging to the Turkish organization fersan.com.tr. This announcement, which appeared on the group's leak site on September 19, 2023, marks a significant escalation in the group's pressure against the target.

According to the claims made by the threat actor, the group possesses sensitive information belonging to the institution. The group alleges that the institution previously attempted to engage in negotiations regarding a ransom payment, but these discussions ultimately failed to reach a successful agreement. To increase the pressure on the organization, the announcement includes a countdown timer, threatening to publish the stolen data if their demands are not met. The group has set a ransom demand of 290,000 USD.

Details of the alleged data theft

The information provided by the threat actor suggests that the breach involves sensitive internal documentation. Based on the screenshots provided by the group, the leaked content appears to include various types of corporate information. The data identified in the announcement includes the following:

• Financial reports
• Internal correspondence

The presence of such documents, including monthly summary tables and financial records, suggests a deep penetration into the organization's administrative and financial systems. Such data exposure often serves the interests of ransomware groups looking to maximize their leverage during extortion attempts.

About fersan.com.tr

Fersan is a Turkey-based food manufacturer that specializes in the production of vinegar, pickles, sauces, and canned goods. With a long-standing history in the industry dating back to its establishment in 1978, the company serves a wide range of customers in both domestic and international markets.

Analysis and potential impact

The claims made by Lockbit3 highlight the ongoing risks faced by established manufacturing entities. The group typically employs double extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak sensitive information publicly to exert maximum pressure. This dual-threat approach is designed to undermine the victim's operational continuity and damage their reputation management efforts.

The potential consequences of this alleged breach are multifaceted. The leaked financial data could pose significant risks to the institution's commercial activities and could potentially be utilized by malicious actors to conduct sophisticated phishing attacks against third parties, such as suppliers or customers. Furthermore, such an event may trigger legal and regulatory obligations, specifically regarding data breach notification requirements under the KVKK.

For organizations operating in the manufacturing sector, these types of incidents underscore the necessity of robust cybersecurity frameworks. Defensive strategies often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access. Additionally, monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are critical components for managing the fallout of a potential breach and ensuring long-term operational resilience.