Lockbit3 ransomware group lists nagase.co.jp on its leak site

• Ransomware group: Lockbit3
• Country: Japan
• Sector: Manufacturing
• Announcement date: April 24, 2023

Lockbit3 claims a massive data breach at Nagase & Co., Ltd.

The Lockbit3 ransomware group has officially listed Nagase & Co., Ltd., a prominent Japan-based firm, on its dedicated leak site. According to the announcement made on April 24, 2023, the threat actors claim to have successfully infiltrated the organization's systems and exfiltrated a significant volume of sensitive information. The group asserts that they have obtained approximately 1TB of data from the target, and they have threatened to publish this information if their demands are not met.

This type of announcement is a hallmark of the double extortion tactic frequently employed by modern ransomware groups. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release confidential information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or personal information. This method increases the pressure on organizations, as the consequences of a data leak can be just as damaging as the operational downtime caused by encryption.

Details of the alleged data theft

The Lockbit3 group provided several document samples as evidence to support their claims during the announcement. These samples, which purportedly belong to Nagase & Co., Ltd., were intended to demonstrate the validity of the breach. Based on the screenshots provided by the group, the stolen data is said to include various sensitive materials. The total volume of the alleged stolen data is stated to be 1TB.

The specific types of data identified in the leak announcement include:

• Passport data
• Corporate presentations
• Corporate documents

While the group has provided some visual evidence, no information was provided regarding the specific ransom demand or the exact file count contained within the 1TB of data.

About Nagase & Co., Ltd.

Nagase & Co., Ltd. is a well-established company based in Japan, with a history dating back to its founding in 1832. The organization specializes in the trading and distribution of a wide range of products, including chemicals, plastics, and electronic materials. Operating within the global supply chain, the company plays a significant role in the sales and distribution of various industrial products on an international scale.

Potential impact and industry implications

If the claims made by the Lockbit3 group are confirmed, the breach could result in significant consequences for the organization. The exposure of personal data belonging to employees and business partners could lead to various risks, including the potential for identity theft. Furthermore, the publication of corporate documents could lead to the disclosure of sensitive trade secrets and strategic plans, which are vital to the company's competitive advantage.

From a regulatory perspective, the organization may face legal liabilities under Japan's Act on the Protection of Personal Information (APPI). Such incidents often require organizations to undergo rigorous investigations and potentially face penalties for failing to protect sensitive data. Additionally, given the established patterns of the Lockbit group, there is a possibility that the leaked data could be utilized in secondary attacks or targeted phishing campaigns against the company or its partners.

For organizations operating in the manufacturing and trading sectors, such incidents highlight the importance of robust cybersecurity frameworks. Protecting the integrity of the supply chain is critical, as a breach in one organization can negatively impact the credibility and security of its entire network of partners. Defensive strategies often include implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security awareness training to mitigate the risk of initial access. Furthermore, maintaining comprehensive backups and an incident response plan is essential for managing the fallout of a potential breach and ensuring business continuity.