Lockbit3 ransomware group lists polycab.com on its leak site

• Ransomware group: Lockbit3
• Country: India
• Sector: Manufacturing
• Announcement date: March 26, 2024

The LockBit ransomware group has listed a significant amount of data on its leak site, alleging that the information belongs to Polycab. According to the group's announcement, the breach involves a substantial volume of sensitive information, potentially impacting the operations of the India-based manufacturing firm.

The details of the alleged attack

The LockBit group has published a post on its dedicated leak site claiming to have targeted Polycab. Through this announcement, the group alleges that they obtained 500 GB of data on March 26, 2024. The group supports its claims by providing various screenshots intended to demonstrate the scope and nature of the access they have gained.

Based on the visual evidence provided by the attackers, the group claims to have successfully gained access to the company's internal records. These records appear to encompass both financial and operational documentation, suggesting a deep penetration into the organization's digital environment. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics—threatening to release sensitive data if a ransom is not paid, even if the initial encryption of systems is bypassed or remediated.

Affected data types

The screenshots shared by the group display various spreadsheets that appear to contain highly sensitive information. The data identified in the leak includes:

• Financial records
• Transaction logs
• Commercial data

These files, which include financial statements and commercial data, highlight the potential sensitivity of the information targeted during the incident.

About Polycab

Polycab is an India-based company that manufactures and sells wires, cables, and fast-moving electrical goods (FMEG) under the POLYCAB brand. The company produces a wide range of electrical equipment, including items such as electric fans and LED lighting. As a significant player in the manufacturing sector, the company maintains various operational and commercial records necessary for its large-scale production and distribution networks.

Analysis and potential impact

The alleged leak may pose significant risks to Polycab's operational continuity and its commercial reputation. The exposure of shared financial data could create secondary risks for the company, specifically affecting its supply chain and its various business partners. Because Polycab is an India-based entity, any potential data breaches may be subject to local data protection regulations, which govern how organizations must handle and report the exposure of sensitive information.

The LockBit group is a known Ransomware-as-a-Service (RaaS) entity that has been active since 2019. Notably, the group has reportedly resumed operations following international disruptions to its infrastructure that occurred in February 2024. The resilience of such groups highlights the ongoing challenge they pose to global cybersecurity defenses.

In the wake of such incidents, organizations typically find it necessary to conduct thorough forensic investigations. Such investigations are essential to determine the exact nature and extent of the leaked data and to understand how the unauthorized access occurred. Furthermore, companies facing such claims often need to notify relevant stakeholders to mitigate further risks to their business ecosystem. For organizations in the manufacturing sector, maintaining robust security postures, implementing strict access controls, and ensuring comprehensive logging of financial and commercial transactions are standard defensive measures used to protect against such threats.