Lockbit3 ransomware group lists gattoplaters.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Manufacturing
• Announcement date: January 22, 2024

LockBit claims responsibility for data breach at Gatto Industrial Platers

The LockBit ransomware group has published data on its leak site that it claims belongs to gattoplaters.com. This announcement, which appeared on the group's platform, indicates a significant breach involving the US-based manufacturing firm.

According to the information released by the threat actor, the attack is alleged to have occurred on January 21, 2024. The group subsequently listed the organization on its leak site on January 22, 2024. This type of activity is characteristic of modern ransomware operations, where groups use public leak sites to pressure victims by threatening to release sensitive information if ransom demands are not met.

Details of the claimed data leak

The LockBit group has announced that it has published approximately 17.21 GB of data, which is claimed to belong to the organization. While the volume of the data is significant, the listing does not provide specific details regarding the exact content or the nature of the files that have been made available for download.

The listing includes general information about the company's operations, but it does not name any specific data types or categories of information that were compromised. Consequently, the specific contents of the 17.21 GB dataset remain unverified.

The organization profile

Gatto Industrial Platers is an ISO 9001:2015 certified industrial plating company that specializes in zinc plating services. Founded in 1974, the firm is a significant player in the metal surface finishing sector, operating North America's largest zinc plating line.

Risks and implications of the incident

This leak, allegedly carried out by the LockBit group, may pose a risk of exposing the organization's operational data and business information. Because the organization is based in the United States, the potential presence of employee or customer information in the leaked data could lead to scrutiny under state-level data privacy laws and regulatory bodies.

Furthermore, the exposed data may be utilized for targeted phishing attacks against the organization's supply chain partners. Such attacks often leverage stolen business context to appear legitimate, increasing the success rate of social engineering attempts against partners and vendors.

Given LockBit's Ransomware-as-a-Service (RaaS) model, it is assessed that the group continues its operations despite international law enforcement efforts. Such persistence by high-profile groups can increase the risk of secondary extortion, where attackers attempt to extort the victim multiple times using different pieces of stolen information.

Defensive considerations for the manufacturing sector

Organizations in the manufacturing sector often face unique risks due to their complex supply chains and integration of operational technology. To mitigate the risks associated with ransomware and data exfiltration, companies typically focus on several defensive layers:

• Implementing robust multi-factor authentication (MFA) across all remote access points and internal systems.
• Maintaining regular, offline, and tested backups to ensure business continuity in the event of encryption.
• Conducting regular security awareness training to help employees identify phishing attempts.
• Maintaining strict network segmentation to prevent lateral movement by attackers within the environment.
• Monitoring for unusual data exfiltration patterns that might indicate a breach is in progress.