Lockbit3 ransomware group lists ginko.com.tw on its leak site

• Ransomware group: Lockbit3
• Country: Taiwan
• Sector: Manufacturing
• Announcement date: July 25, 2022

LockBit3 claims data breach at Ginko International

The entity ginko.com.tw has been listed on the leak site of the LockBit ransomware group. The LockBit group claims to have obtained data belonging to ginko.com.tw and has published the entity on its leak site. This announcement was created on July 25, 2022, suggesting that the group intended to exert pressure on the entity starting from that date.

Details of the alleged attack

According to the claims made by the LockBit group, they gained access to the entity's network and exfiltrated data. The group's announcement, dated July 25, 2022, serves as a method of public pressure against the target. In many ransomware scenarios, groups use these leak sites to demonstrate the success of their intrusion and to coerce victims into meeting demands through the threat of public exposure.

Regarding the specifics of the breach, no screenshots or detailed information regarding the nature of the allegedly leaked data have been provided. The listing names no specific data types or files.

Organization profile

Ginko International is a Taiwan-based contact lens manufacturer. The company specializes in the design, production, and sale of optical products, with a significant presence in the Chinese market.

Risk assessment and implications

This situation may lead to disruptions in the entity's operational continuity and the exposure of sensitive commercial data. If the leak occurs, secondary risks such as targeted phishing attacks against the entity's customers and business partners may be observed. Such secondary attacks often follow a breach, as threat actors leverage stolen information to gain further trust during social engineering attempts.

The LockBit group is a Ransomware-as-a-Service (RaaS) group monitored since 2019, and it is reported that they have resumed activities despite international operations in February 2024. The persistence of such groups highlights the ongoing nature of the threat landscape.

To mitigate possible negative impacts, the entity may consider reviewing its data security processes and taking necessary precautions against potential data breaches. Organizations in similar sectors often prioritize hardening their network perimeters, implementing strict access controls, and enhancing monitoring capabilities to detect unauthorized exfiltration attempts early in the attack lifecycle.