Lockbit3 ransomware group lists norseman.ca on its leak site

• Ransomware group: Lockbit3
• Country: Canada
• Sector: Manufacturing
• Announcement date: November 19, 2022

LockBit3 claims attack on Norseman Structures

The LockBit3 ransomware group has officially announced the listing of the organization associated with the domain norseman.ca on its dedicated leak site. According to the announcement made on November 19, 2022, the group claims that a discovery or an attack involving the entity took place on that same date. This development follows a pattern common among ransomware-as-a-service (RaaS) operations, where threat actors target specific organizations to exert pressure through public exposure.

Ransomware leak sites serve as a platform for cybercriminals to host information stolen during breaches. These sites are often used as a tool for double extortion, a tactic where attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive data. By threatening to release this data publicly, the attackers aim to coerce the victim into paying a ransom to prevent the exposure of their proprietary or personal information.

Details of the claimed event

Regarding the specifics of the incident, the announcement provided very limited information. While the group has listed the entity on its platform, the listing does not contain any information regarding the volume of data involved or a specific ransom demand. The lack of details regarding the scale of the breach is not uncommon in the early stages of a leak site posting, as groups often use these listings as a preliminary step in their extortion process.

The listing names no specific data types or screenshots regarding the nature of the leaked information. Consequently, the exact contents of the alleged breach remain unverified through the group's public announcement.

About Norseman Structures

Norseman Structures is a Canada-based manufacturing company. The organization specializes in the design and production of steel-framed fabric structures. Their products are primarily intended for use across the agricultural, industrial, and commercial sectors.

Potential implications and security considerations

This situation may indicate that data within norseman.ca could have been subjected to unauthorized access. Given the organization's location in Canada, potential data breaches may fall under the scope of the Personal Information Protection and Electronic Documents Act (PIPEDA). The exposure of such data could create secondary risks for employees or customers, such as identity theft and targeted phishing attacks.

LockBit is a RaaS group that has been tracked since 2019. Despite international law enforcement actions in February 2024, it has been reported that the group has resumed operations. The impact of such attacks can be significant, potentially causing negative effects on an organization's operational continuity and its internal data security policies.

To defend against such threats, organizations in the manufacturing sector often implement various defensive measures. These include robust backup strategies to ensure operational continuity, multi-factor authentication to prevent unauthorized access, and continuous monitoring of network traffic to detect anomalous behavior. Furthermore, maintaining strict adherence to regional data protection regulations is a critical component of a comprehensive cybersecurity posture to mitigate legal and secondary risks to stakeholders.