Lockbit3 ransomware group lists losh.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Technology
• Announcement date: August 30, 2023

LockBit3 claims data breach against Losh Communications

The LockBit3 ransomware group has listed the technology firm losh.com on its dedicated leak site, threatening to publish allegedly stolen data. This announcement follows a pattern of extortion where threat actors claim to have compromised sensitive information to pressure victims into paying a ransom.

Details of the alleged attack

On August 30, 2023, the LockBit group published a notice claiming to have compromised data belonging to losh.com. Following this announcement, the group initiated a countdown process, a common tactic used to increase psychological pressure on the target organization by setting a deadline for the publication of the institution's data.

LockBit is a well-known Ransomware-as-a-Service (RaaS) group that has been active since 2019. The group's infrastructure faced significant disruption due to international operations in February 2024, yet reports indicate that the group has since resumed its operations. This resilience highlights the ongoing challenges posed by sophisticated ransomware operations that continue to evolve despite law enforcement interventions.

Data and content of the leak

Regarding the specifics of the incident, no details or sample files regarding the allegedly leaked data have been provided by the threat actors. The listing does not specify the volume of data or the specific types of files that have been targeted.

Affected data types

• The listing names no specific data types.

About Losh Communications

Losh Communications is a technology company founded in 1990. While the company initially focused on installing business telephone systems, it has since evolved into a leading IT service provider. The organization is based in Columbus, Ohio, and provides a range of comprehensive IT services to its clients.

Impact and security implications

As the institution is a technology service provider, a potential data breach could lead to the exposure of client information and trade secrets. Such an incident may undermine the operational credibility of the firm and result in significant reputational damage among its clients. Depending on the nature of the data, secondary risks such as targeted phishing attacks or supply chain compromises may emerge.

Given the known tactics of the LockBit group, it is possible that the institution has been subjected to double extortion. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This dual-threat approach increases the leverage of the ransomware group, as the victim faces both operational downtime and the risk of regulatory penalties or loss of intellectual property.

For organizations operating within the technology sector, such incidents underscore the importance of robust defensive measures. Common security practices to mitigate these risks include maintaining rigorous backup protocols, implementing multi-factor authentication, and conducting regular vulnerability assessments. Furthermore, because technology providers often hold the keys to their clients' digital environments, protecting against supply chain compromises is a critical component of modern cybersecurity defense strategies.