Lockbit3 ransomware group lists kyocera-avx.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Technology
• Announcement date: May 26, 2023

Lockbit3 claims to have compromised Kyocera AVX data

The Lockbit3 ransomware group has officially listed the technology company kyocera-avx.com on its dedicated leak site. According to the group's announcement, they claim to have successfully compromised the organization's data and have asserted their intent to publish the stolen information publicly. This move follows a common pattern used by modern ransomware actors to exert pressure on their targets through public exposure of sensitive information.

The event was officially announced on the group's leak portal on May 26, 2023. The group's claim includes a countdown period, stating that the information will be released to the public once the timer expires. The listing identifies the target as an international manufacturer specializing in electronic components, marking a significant potential breach for a player in the global technology supply chain.

Data types identified in the alleged leak

While the specific volume of data and the total file count have not been disclosed by the attackers, screenshots shared by the group provide a glimpse into the nature of the stolen content. The samples provided by the threat actors suggest that the breach involves highly sensitive documentation. The information identified in these samples includes various types of private and financial records.

Affected data types:

• Bank account details
• Passport information
• Financial statements

The presence of such sensitive documentation, particularly identity-related files like passport copies, significantly elevates the severity of the incident. Such data is highly valuable on illicit markets and can be used for various malicious purposes by cybercriminals.

About Kyocera AVX

Kyocera AVX is a global technology company that specializes in the design and manufacture of advanced electronic components. Their product portfolio is diverse, encompassing sensors, control systems, and antennas. The company serves as a critical provider for multiple essential sectors, offering specialized solutions for the automotive, industrial, medical, and telecommunications industries.

Risk assessment and industry implications

The involvement of Lockbit3, a ransomware-as-a-service (RaaS) group that has been active since 2019, highlights the persistent threat posed by professionalized cybercrime organizations. Despite international law enforcement efforts in February 2024, the group has reportedly resumed its operations. The tactics used in this instance appear to follow the double-extortion model, where attackers not only encrypt systems but also steal data to threaten its public release, thereby increasing the pressure on the victim to pay the ransom.

The nature of the data allegedly stolen—including personal identification and financial documents—poses a heightened risk of identity theft and targeted phishing attacks directed at the organization's employees and stakeholders. For a US-based organization, such a breach could potentially trigger complex legal proceedings under relevant state laws and federal regulations regarding data protection and privacy.

For organizations operating within the technology and electronics manufacturing sectors, this incident underscores the critical importance of supply chain security. A breach at a major component manufacturer can have cascading effects on downstream partners and customers. To mitigate these risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee security awareness training to defend against phishing. Furthermore, maintaining comprehensive incident response plans and ensuring robust data encryption for sensitive files can help minimize the impact of a successful intrusion.