Lockbit3 ransomware group lists mayair.com.my on its leak site

• Ransomware group: Lockbit3
• Country: Malaysia
• Sector: Manufacturing
• Announcement date: August 31, 2023

LockBit claims data breach at MayAir

The LockBit ransomware group has listed the Malaysian manufacturing firm mayair.com.my on its dedicated leak site. According to the announcement made on August 31, 2023, the threat actor group claims to have successfully compromised data belonging to the organization. The group has asserted that all available data stolen from the entity will be published on their platform.

To provide evidence for their claims of a successful intrusion, the threat actors have released several screenshots of various corporate documents. This tactic is common among ransomware groups seeking to pressure victims into meeting their demands. The group's activity has been noted since 2019, and they have demonstrated a persistent ability to continue operations despite various international law enforcement efforts aimed at dismantling their infrastructure.

Details of the alleged data theft

The screenshots provided by the LockBit group suggest that the breach involves sensitive corporate documentation. Based on the visual evidence shared by the attackers, the following types of information are reportedly involved in the leak:

• Personnel lists
• Official government documents
• Loan agreements

The specific volume of the data, the total number of files, and the specific amount of the ransom demand have not been disclosed in the announcement. The group's claim of a breach remains an allegation made by the threat actor.

About MayAir

MayAir is a leading air filtration company specializing in the manufacturing, development, and supply of air filtration equipment and HEPA filters.

Impact and risks of the alleged breach

The alleged breach poses significant risks to the entity's operational continuity and its commercial reputation. The nature of the shared documents indicates that the personal data of both employees and business partners may be compromised. Such a situation may lead to the organization facing legal obligations under the Personal Data Protection Act (PDPA) in Malaysia.

LockBit is known for employing a double-extortion method. In this model, attackers not only encrypt an organization's data but also steal it, threatening to publish it online to increase leverage. Consequently, the publication of stolen data can lead to secondary risks, including identity theft and highly targeted phishing attacks against the affected individuals.

For organizations operating in the manufacturing sector, maintaining robust cybersecurity posture is essential to protect intellectual property and sensitive corporate data. Common defensive strategies include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing. Furthermore, ensuring compliance with regional data protection regulations is a critical component of managing the legal risks associated with potential data exposure.