Lockbit3 ransomware group lists hanwha.com on its leak site

• Ransomware group: Lockbit3
• Country: South Korea
• Sector: Manufacturing
• Announcement date: September 8, 2023

LockBit3 claims to have stolen data from Hanwha Group

The LockBit ransomware group has listed hanwha.com on its dedicated leak site, making claims regarding a significant data breach involving the organization. According to the announcement posted on September 8, 2023, the threat actor group asserts that they have successfully compromised and obtained a substantial amount of sensitive information belonging to the South Korean entity.

The group's claim involves a massive volume of data, which they state totals 800 GB. This announcement is part of the ongoing trend where ransomware groups utilize leak sites to pressure victims through double extortion tactics. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also threaten to publish stolen data to damage the victim's reputation and force a ransom payment.

Details of the alleged data theft

The announcement made by the LockBit group on September 8, 2023, includes various bulletins and sample images intended to prove the validity of their claims. These samples allegedly contain sensitive documentation that could provide insight into the internal workings of the organization. The group claims to possess a wide variety of corporate information, ranging from administrative records to specialized operational documents.

The specific types of data allegedly included in the breach involve several critical business functions. According to the group's claims, the stolen information encompasses:

• Financial reports
• Logistics documents
• HR data
• Quality control documents
• Contracts

The presence of such diverse data types, including logistics and quality control records, suggests that the breach could impact various levels of the organization's operational hierarchy.

About Hanwha Group

Hanwha Group is a major South Korean conglomerate operating in diverse sectors including aerospace, energy, materials, finance, and retail. It continues to grow globally with a balanced portfolio by quickly adapting to rapidly changing business environments.

Potential impact and security implications

This claim by the LockBit group may pose risks to the organization's operational continuity and commercial reputation. The leaked documents, which allegedly include financial and logistics records, could create secondary risks for the organization's supply chain partners and trade secrets. Furthermore, as a South Korean-based entity, a potential data breach could trigger legal obligations under the Personal Information Protection Act (PIPA).

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported that the group resumed operations after its infrastructure was disrupted by an international operation in February 2024. The persistence of such groups highlights the ongoing challenge faced by large-scale enterprises in defending against sophisticated cyber threats.

For organizations in the manufacturing and conglomerate sectors, such incidents underscore the necessity of robust cybersecurity frameworks. To mitigate the impact of potential breaches, organizations often implement defensive measures such as network segmentation, multi-factor authentication, and continuous monitoring of internal networks. In the event of a suspected breach, a comprehensive forensic investigation on internal networks is often required to verify the claims made by threat actors and to understand the full scope of the incident.