Lockbit3 ransomware group lists redfordpd.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Government & Defense
• Announcement date: February 3, 2023

LockBit3 claims data breach at Redford Police Department

The ransomware group known as LockBit3 has officially listed the Redford Police Department on its leak site, claiming a successful compromise of the agency's networks. According to the announcement made on February 3, 2023, the threat actors allege they have gained unauthorized access to the systems of both redfordpd.com and cityofallenpark.org. This incident is characterized as a data breach, with the group indicating that the stolen information is intended for publication on their dedicated leak site.

The group claims to have exfiltrated a significant volume of information, totaling 165 GB of data. While the group has made these claims, no screenshots or visual evidence were provided in the announcement to verify the contents of the stolen files. This type of announcement is a common tactic used in ransomware-as-a-service (RaaS) operations, where attackers use the threat of public disclosure to pressure organizations into meeting ransom demands.

Details of the alleged data exfiltration

The information allegedly stolen by the LockBit3 group is highly sensitive, given the nature of the targeted organization. The group claims to have accessed a variety of internal files and records. According to the announcement, the alleged data includes the following types of information:

• Financial records
• Document scans
• Victim data
• Crime scene photos
• Department reports
• Passwords

The inclusion of such diverse data types suggests a deep level of access into the administrative and operational directories of the affected networks. The presence of passwords and document scans, in particular, indicates that the breach could have significant implications for the security of the entire network infrastructure.

About the Redford Police Department

The Redford Police Department is a local law enforcement agency. It serves the Redford Charter Township located in the state of Michigan, United States. As a public safety entity, the department handles sensitive information related to community safety, criminal investigations, and administrative operations.

Implications and organizational risks

The alleged leak of this data poses a substantial risk to the institutions involved, as it may expose sensitive operational data. The potential disclosure of specific items, such as crime scene photos and victim data, could lead to significant legal consequences under data protection regulations, such as HIPAA or other relevant state laws. Furthermore, the publication of such sensitive information can create secondary risks for the individuals involved, including the potential for identity theft and targeted phishing attacks.

LockBit3 is a known RaaS operation that has been tracked since 2019. The group has demonstrated a high level of capability, suggesting it may possess the capacity to continue its activities despite various infrastructure disruptions. For organizations in the government and defense sector, such attacks highlight the critical need for robust cybersecurity frameworks.

When faced with such incidents, organizations often must fulfill specific data breach notification obligations to comply with legal requirements. Additionally, conducting thorough security audits on affected systems is a necessary step to identify vulnerabilities and prevent future unauthorized access. Implementing defensive measures such as multi-factor authentication, network segmentation, and regular offline backups are standard industry practices to mitigate the impact of ransomware and data exfiltration attempts.