Lockbit3 ransomware group lists rosenbauer.com on its leak site

• Ransomware group: Lockbit3
• Country: Austria
• Sector: Manufacturing
• Announcement date: February 27, 2023

Lockbit3 claims data breach against Rosenbauer

The Lockbit3 ransomware group has officially listed the Austrian organization Rosenbauer on its dedicated leak site. According to the announcement made on February 27, 2023, the threat actor group claims to have successfully targeted the entity associated with the domain rosenbauer.com. This development follows a pattern of double extortion tactics frequently employed by modern ransomware operations, where attackers not only encrypt systems but also threaten to publish sensitive information to pressure the victim into paying a ransom.

The claim made by the group suggests a significant breach of the organization's digital perimeter. While the specific circumstances of the initial intrusion remain unconfirmed, the presence of the company on a known ransomware leak site indicates a high-pressure situation for the targeted entity. Such incidents often involve complex stages, including initial access, lateral movement within the network, and the eventual exfiltration of data before the ransomware payload is deployed.

Details of the alleged attack and data exfiltration

The announcement by Lockbit3 includes several specific claims regarding the nature of the breach and the volume of information stolen. The group has issued a notice indicating that the data involved may be published on their platform. The post specifically includes alleged system access credentials, which consist of usernames and passwords that may grant unauthorized access to the organization's internal systems.

Regarding the volume of information, the group claims to have exfiltrated a substantial amount of data. The specific details provided in the leak site post include:

• Alleged system access credentials (usernames and passwords)
• A total data size claimed to be 232 GB

It is important to note that while the group has provided these details, no screenshots were provided in the announcement to substantiate the claims. Furthermore, no information was provided regarding the specific file count or the amount of ransom demanded by the attackers.

About Rosenbauer

Rosenbauer is an Austria-based company that serves as a global leader in the production of fire trucks and firefighting equipment. With over 150 years of experience, the organization operates numerous manufacturing facilities worldwide, making it a significant player in the global manufacturing sector.

Risk assessment and industry implications

The sharing of access credentials by the Lockbit3 group poses a direct risk of unauthorized access to the entity's systems. Furthermore, the alleged 232 GB of data could potentially impact the entity's operational continuity and trade secrets. Depending on the jurisdiction, the entity may face data breach notification obligations under relevant data protection regulations. Additionally, if the leaked data contains employee or customer information, secondary risks such as identity theft and targeted phishing attacks may emerge.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Although its infrastructure was disrupted by an international operation in February 2024, it has been reported to have resumed its activities. This resilience highlights the ongoing challenge posed by organized cybercrime groups that adapt to law enforcement interventions.

For organizations operating in the manufacturing sector, such incidents underscore the necessity of robust defensive measures. Implementing multi-factor authentication (MFA) is a critical step in mitigating the risk of stolen credentials being used for unauthorized access. Additionally, maintaining rigorous network segmentation can help prevent attackers from moving laterally through the network to reach sensitive data. Organizations should also prioritize comprehensive monitoring and logging to detect anomalous behavior that might indicate an ongoing exfiltration event. Regular data backups, stored offline or in immutable formats, remain a fundamental component of a resilient incident response strategy to ensure operational continuity in the event of a ransomware deployment.