Lockbit3 ransomware group lists floodlaw.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: May 26, 2023

LockBit3 claims data breach at Flood Law

The LockBit3 ransomware group has listed floodlaw.com on its dedicated leak site, claiming to have successfully obtained the firm's data. This announcement, made on May 26, 2023, marks a significant escalation in the group's targeting of professional services. By listing the organization on their platform, the threat actors aim to exert pressure through the threat of public data exposure.

According to the group's announcement, they have gained access to the firm's internal files. The listing includes specific information regarding the firm's operations and has initiated a countdown timer, a common tactic used by ransomware groups to create a sense of urgency and pressure the victim into meeting their demands before the stolen information is released to the public.

Details of the alleged data theft

While the specific volume of data and the exact number of files stolen have not been disclosed by the group, the screenshots provided by the attackers offer a glimpse into the nature of the compromised information. The leaked material appears to contain highly sensitive documentation that could have severe implications for the individuals involved.

The screenshots displayed by the group include various types of sensitive documents, such as:

• Identity information
• Passport details
• Legal documents
• Confidentiality agreements

The presence of such documents highlights the high-value nature of the target, as legal firms often serve as repositories for the most private and sensitive information of their clients.

About Flood Law

Flood Law is a professional services firm based in the United States. Established in 2002, the firm is composed of former prosecutors. It provides a range of litigation and legal consulting services, supported by a team of attorneys who specialize in the criminal justice system.

Implications and analysis of the threat

This potential leak carries significant risks, particularly regarding the possibility of identity theft and fraud for both the law firm's clients and its employees. Because law firms handle sensitive client information that is protected under professional privilege and various state laws, such a breach may lead to serious legal repercussions for the organization.

The LockBit3 group typically employs double extortion tactics. In a double extortion scheme, attackers do not merely encrypt a victim's data to disrupt operations; they also steal sensitive information and threaten to leak it publicly if a ransom is not paid. This method is designed to maximize leverage by threatening the victim's reputation and legal standing. The publication of this data could violate client confidentiality and cause lasting damage to the firm's reputation.

LockBit3 is a ransomware group that has been active since 2019. Despite experiencing operational disruptions in February 2024, the group has been observed continuing its operations. This persistence highlights the ongoing threat posed by established ransomware-as-a-service (RaaS) operations.

For organizations in the professional services sector, such incidents underscore the necessity of robust cybersecurity frameworks. Protecting sensitive data requires a multi-layered defense strategy, including regular security audits, strict access controls, and comprehensive encryption protocols for data at rest and in transit. Maintaining high standards of data hygiene and implementing rapid incident response plans are critical steps for mitigating the impact of such targeted attacks.