Lockbit3 ransomware group lists saurer.com on its leak site

• Ransomware group: Lockbit3
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: October 30, 2022

LockBit claims data compromise of Saurer

The LockBit ransomware group has listed the Swiss-based organization saurer.com on its dedicated leak site. According to the announcement made by the threat actor, the organization's data has been compromised. The post detailing this claim was published on October 30, 2022.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In such scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive information. The threat of releasing this stolen data publicly serves as leverage to compel the victim into paying a ransom. While the listing on a leak site is a claim made by the threat actor, it highlights the ongoing risks faced by industrial entities in the modern threat landscape.

Details of the alleged breach

Regarding the specific details of the incident, the information provided by the group remains limited. There is no information regarding the nature of the leaked data, and no screenshots were provided by the attackers to substantiate their claims. Furthermore, the listing does not specify the total volume of data involved or the specific number of files that were allegedly exfiltrated.

Affected data types

• The listing names no specific data types.

About Saurer

Saurer is a long-established Swiss-based industrial technology company specializing in the production of spinning and textile machinery. The company provides complete solutions, machinery, and components for the textile industry.

Threat actor profile and potential impact

The LockBit group is a known threat actor that has been active since 2019, operating under a Ransomware-as-a-Service (RaaS) model. This model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks. Although the group's infrastructure was disrupted by international operations in February 2024, it has been reported to have resumed its activities.

The leakage of an organization's data can lead to significant secondary risks. For a specialized industrial company, the exposure of employee or customer information can create a cascade of complications. Such leaks may create negative impacts on the organization's commercial reputation and could trigger legal processes under relevant data protection regulations.

In the manufacturing sector, where intellectual property and supply chain integrity are paramount, organizations often prioritize defensive measures to mitigate these risks. Common defensive steps include implementing robust access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration. Maintaining a strong security posture is essential to protect against the various stages of a ransomware attack, from initial access to the final stages of data theft and extortion.