Lockbit3 ransomware group lists mipe.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Transportation
• Announcement date: August 4, 2023

The LockBit3 ransomware group has claimed responsibility for a data breach targeting Mission Petroleum Carriers, Inc. (mipe.com). According to an announcement posted on the group's leak site, the threat actor group asserts that they have successfully exfiltrated sensitive information belonging to the organization.

The details of the claim

The listing of mipe.com on the LockBit3 leak site occurred on August 4, 2023. In the announcement, the group claims to have obtained the institution's data and has issued threats to publish the stolen information within a specified timeframe. This tactic is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt an organization's systems but also threaten to release sensitive data to pressure the victim into paying a ransom.

To support their claims, the group shared several screenshots of various documents in their announcement. These images allegedly represent the institution's internal operational processes, serving as proof of the breach to the public and the targeted organization.

Data types involved in the leak

Based on the screenshots provided by the attackers, the leaked content appears to include various types of sensitive business documentation. The shared images display several categories of information that could be highly sensitive to the company's operations. The specific items identified in the announcement include:

• Financial invoices
• Operational logistics data
• Business process notes

The visual evidence provided by the group includes samples of invoices, notes regarding operational support, and spreadsheet files that contain information related to inventory or logistics data.

About Mission Petroleum Carriers, Inc.

Mission Petroleum Carriers, Inc. is a bulk commodity transport company that operates throughout Texas and its surrounding states. The company's primary business focus is centered on the gathering and transportation of crude oil.

Risk assessment and industry implications

This claim of a data leak poses significant risks to the institution's operational continuity and its commercial confidentiality. Because the leaked data includes logistics and financial information, it may create secondary risks for the organization's various supply chain partners. In a complex logistics environment, the exposure of such data can compromise the security and trust within the broader network of providers and clients.

As a United States-based institution, the organization may be subject to state-level data protection regulations and potential notification obligations resulting from such an incident. Furthermore, the exposure of internal data increases the risk of secondary attacks, such as identity theft or targeted phishing campaigns directed at the institution's customers and employees.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Although its infrastructure was disrupted by international operations in February 2024, reports indicate that the group has since resumed its activities. Organizations in the transportation and energy sectors often face these types of threats and typically implement defensive measures such as robust encryption, multi-factor authentication, and strict access controls to mitigate the impact of such breaches.