Lockbit3 ransomware group lists sanmiguel.iph on its leak site

• Ransomware group: Lockbit3
• Country: Philippines
• Sector: Manufacturing
• Announcement date: November 1, 2023

LockBit3 claims to have compromised San Miguel Corporation

The LockBit3 ransomware group has claimed responsibility for a data leak involving San Miguel Corporation, a major conglomerate based in the Philippines. According to an announcement made on the group's leak site on November 1, 2023, the threat actors claim to have successfully compromised the organization's data and have threatened to publish the stolen information.

This type of activity is characteristic of modern ransomware operations, specifically the "double extortion" model. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The goal is to pressure the victim into paying a ransom by threatening to release the stolen information publicly, which can lead to significant regulatory, legal, and reputational consequences.

Details of the claimed breach

The claim made by LockBit3 suggests that the group has gained unauthorized access to various internal files. While the specific volume of data and the exact amount of the ransom demand have not been disclosed in the announcement, the group has provided visual evidence to support their claims. Screenshots shared by the attackers appear to show samples of various internal documents belonging to the organization.

The content of these screenshots indicates that the compromised information includes a variety of sensitive corporate materials. The specific types of data mentioned in the leak include:

• Financial records
• Audit reports
• Insurance certificates
• Corporate documents

The presence of such documents suggests that the attackers may have gained access to the internal directory structures and core administrative files of the company.

About San Miguel Corporation

San Miguel Corporation is one of the largest and most diversified conglomerates in the Philippines. Founded in 1890 as a brewery, the company has grown significantly over the decades and now operates in various sectors including food, beverage, packaging, fuel, power, and infrastructure.

Potential impact and organizational risks

The alleged leak poses several significant risks to the organization. The exposure of financial records and audit reports could have negative impacts on the organization's operational continuity and commercial reputation. Furthermore, the disclosure of internal processes and financial data could lead to a loss of trust among the organization's supply chain partners and customers.

Beyond the immediate reputational damage, there is a risk that the leaked data could be utilized by malicious actors for identity theft or targeted phishing attacks against the company or its stakeholders. When sensitive corporate documents are exposed, attackers often use the information to craft highly convincing social engineering campaigns, making them more effective at gaining further access to networks or defrauding employees and partners.

LockBit is a ransomware group that has been active since 2019. Despite facing international disruptions in February 2024, the group reportedly resumed its operations. For organizations operating in large-scale manufacturing and diversified sectors, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, conducting regular security audits, and ensuring comprehensive employee training to recognize phishing attempts. Protecting the integrity of financial and audit data is essential for maintaining the trust of investors, partners, and the public.