Lockbit3 ransomware group lists nosm.ca on its leak site

• Ransomware group: Lockbit3
• Country: Canada
• Sector: Education
• Announcement date: June 6, 2023

Lockbit3 claims data breach at Northern Ontario School of Medicine University

The LockBit ransomware group has listed the domain nosm.ca on its dedicated leak site, claiming to have conducted a cyberattack against the Northern Ontario School of Medicine University. This announcement, made on June 6, 2023, follows an alleged attack that took place on June 3, 2023. The threat actor group has initiated a countdown process, signaling their intent to publish all available data belonging to the institution.

Details of the alleged attack and claims

According to the information provided by the LockBit group, the institution's domain was added to their leak site as part of a data leak announcement. The group has asserted that they have gained access to the institution's environment and are prepared to release the stolen information. By using a countdown mechanism, the group employs a common tactic used in ransomware operations to pressure victims into meeting their demands before the data is made public.

Ransomware groups often utilize these leak sites to conduct double extortion campaigns. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This dual pressure tactic aims to maximize the likelihood of a ransom payment by threatening the victim's reputation and legal standing.

Data involved in the incident

While the group has announced the intent to release data, the specific content of the alleged leaked data set remains unclear. The available information provides limited visibility into the exact nature of the files stolen. However, operational screenshots related to the incident show texts concerning the institution's housing management and logistics processes. Beyond these operational details, there is no clear information regarding the specific content of the alleged leaked data set, and the group has not provided details regarding the total size of the data or the specific number of files involved.

About the Northern Ontario School of Medicine University

The Northern Ontario School of Medicine University is a public medical university situated in the Canadian province of Ontario. The institution serves a critical role in the region, as it is mandated to educate doctors and contribute to the provision of healthcare in Northern Ontario's urban, rural, and remote communities.

Risk assessment and implications for the education sector

This situation carries a significant risk regarding the potential leakage of the institution's operational data and sensitive information. Because the organization operates within the education sector, the exposure of student and staff data could potentially lead to serious consequences, such as identity theft or targeted phishing attacks against members of the academic community.

Furthermore, the institution may face legal obligations under Canadian data protection regulations following such a breach. The exposure of sensitive personal information often triggers mandatory reporting requirements to regulatory bodies and affected individuals. Given the established history and past activities of the LockBit group, it is assessed that such leaks could damage the institution's reputation and potentially pave the way for secondary extortion attempts, where attackers attempt to extort the victim multiple times for the same data.

To defend against such threats, organizations in the education and healthcare sectors typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups is a critical component of a resilient cybersecurity posture to ensure that data can be recovered without complying with ransom demands.