Lockbit3 ransomware group lists signiflow.com on its leak site

• Ransomware group: Lockbit3
• Country: South Africa
• Sector: Technology
• Announcement date: December 7, 2023

Lockbit3 claims to have stolen data from signiflow.com

The Lockbit3 ransomware group has officially listed signiflow.com on its dedicated leak site. According to the group's announcement, they claim to possess significant amounts of data belonging to the digital signature software provider. This listing follows a pattern often seen in ransomware operations, where threat actors use public leak sites to pressure organizations by threatening to release sensitive information.

On December 7, 2023, the Lockbit group added the organization to its platform, alleging that they have successfully obtained data from the company. The group's claims suggest that the compromised information is deeply integrated into the company's core business functions. Specifically, the attackers allege that they hold various documents related to the organization's digital signature workflow processes, which are central to the company's service offerings.

The group's announcement further specifies that the stolen information is not limited to general documentation. The listing claims that the breach includes critical client files and sensitive network credentials. Such information is highly valued by cybercriminals, as it can provide a roadmap for further unauthorized access or be used for extortion purposes.

The alleged stolen data includes client files and network credentials

The details provided by the threat actors regarding the nature of the stolen data suggest a wide-ranging compromise. The group claims to have access to a variety of sensitive documents and technical information. According to the listing, the compromised data includes the following items:

• Client files
• Contracts
• Non-disclosure agreements (NDAs)
• Project information
• Network credentials
• Financial documents

In addition to the list of data types, the group has provided visual evidence to support their claims. The provided screenshots allegedly display samples of sensitive documents, including mortgage loan application forms and various sales proposals. This type of evidence is frequently used by ransomware groups to demonstrate the legitimacy of their claims and to increase the pressure on the victimized organization.

About signiflow.com

Signiflow is a technology company based in South Africa that specializes in digital signature workflow software. The company provides tools designed for documents that require formal legal signatures or official approvals. Since its founding in 2013, the organization has focused on the digitization of business processes through the implementation of advanced electronic signature solutions.

Potential risks and industry implications

This alleged breach may pose a high risk to the clients of signiflow.com, particularly given the specialized nature of its digital signature platform. Because the platform is used to facilitate legal and official approvals, the integrity and confidentiality of the data handled by the service are paramount. The exposure of sensitive contracts and financial documents increases the risk of identity theft and fraud for the affected parties involved in these transactions.

Furthermore, the claim that network credentials were stolen presents a significant security concern. These credentials could potentially facilitate secondary attacks against other entities within the organization's supply chain, as attackers often use stolen credentials to move laterally through interconnected business networks. Depending on the specific jurisdiction governing the affected parties, the organization may face regulatory scrutiny or administrative penalties under frameworks such as the General Data Protection Regulation (GDPR).

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. While the group's infrastructure was disrupted by an international law enforcement operation in February 2024, the group has demonstrated a persistent tendency to continue its operations despite such interventions. For organizations in the technology and digital workflow sector, such incidents underscore the importance of robust access controls, multi-factor authentication, and rigorous supply chain security management to mitigate the impact of potential credential theft.