Lockbit3 ransomware group lists nokair.com on its leak site

• Ransomware group: Lockbit3
• Country: Thailand
• Sector: Transportation
• Announcement date: February 28, 2023

LockBit claims data breach at Nok Air

The LockBit ransomware group has published an announcement on its leak site targeting Nok Air, a prominent airline based in Thailand. According to the claim made by the threat actor group, the organization's networks were compromised, leading to the exfiltration of data. This announcement was made on February 28, 2023, and the group alleges that they successfully gained unauthorized access to the airline's internal systems.

Ransomware groups often utilize leak sites to apply pressure on their victims through a tactic known as double extortion. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations, but they also steal sensitive information beforehand. The threat of releasing this stolen data publicly serves as a powerful lever to coerce the victim into paying a ransom. While the listing on a leak site is a significant indicator of a potential security incident, it represents the claims of the threat actor group.

Details of the claimed incident

The announcement published by LockBit suggests a targeted intrusion into the airline's digital infrastructure. The group claims to have successfully moved through the network to identify and extract data. However, despite the claim of a successful exfiltration, the group has not provided specific details regarding the nature of the files they allege to have stolen. The listing does not include any screenshots or detailed information regarding the specific types of data that were purportedly taken from the organization.

The following details regarding the specific data involved remain unknown:

• No specific data types were named in the listing.

Because no specific information or screenshots were provided by the group, the exact scope and content of the alleged breach remain unverified. The absence of detailed data descriptions is a common occurrence in the early stages of a leak site posting, where the primary goal is to signal the breach to the victim and the public.

About Nok Air

Nok Air is a low-cost airline that is based in Bangkok, Thailand. The company primarily provides domestic flight services within the country. Notably, Thai Airways International is among the shareholders of the organization, indicating its position within the regional aviation landscape.

Risk assessment and industry implications

The claims made by the LockBit group pose a potential risk to the privacy of both customers and employees. If the allegations are accurate, the leaked data could potentially be utilized for malicious purposes, such as identity theft or highly targeted phishing attacks against the airline's stakeholders. Furthermore, a data breach involving an organization operating within the airline sector can trigger complex legal processes under various data protection regulations.

The implications of such an event extend beyond the immediate organization. The supply chain partners of Nok Air may also be indirectly affected by this situation, as interconnected digital ecosystems mean that a breach in one company can create ripple effects across its business network. This underscores the importance of robust cybersecurity measures not just for the primary target, but for all entities within the service chain.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been monitored by security researchers since 2019. The group's infrastructure was previously disrupted by an international law enforcement operation in February 2024, though it has been reported that the group resumed its operations following that disruption. Organizations in the transportation and aviation sectors typically focus on defensive strategies such as implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular network segmentation to mitigate the risk of such intrusions.