Lockbit3 ransomware group lists smudlers.com on its leak site

• Ransomware group: Lockbit3
• Country: Belgium
• Announcement date: December 20, 2023

Lockbit3 claims to have exfiltrated 600 GB of data from smudlers.com

The Lockbit3 ransomware group has listed smudlers.com on its dedicated leak site, claiming to have successfully exfiltrated 600 GB of data from the organization. This announcement, made on December 20, 2023, marks a significant escalation in the group's targeting of the industrial sector. While the group has made these claims, the details provided by the threat actor suggest a wide-ranging compromise of sensitive corporate and personal information.

The details of the alleged breach

According to the announcement made by the Lockbit3 group, the organization's data has been compromised. The group alleges that the stolen information includes documents related to the company's engineering and steel construction projects, alongside various forms of personal data. The group stated that these files were last updated on December 20, 2023, and they have indicated that the data would be released to the public.

The group has provided screenshots as evidence of the breach. These images reportedly display a variety of sensitive information, including:

• Passport data
• Personnel lists
• Financial statements
• Technical drawings

Ransomware groups often employ a technique known as double extortion, where they not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on a public site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of trade secrets or personal information.

About smudlers.com

Smulders is an international steel construction company with over 50 years of experience in the engineering, construction, supply, and assembly of steel structures. The company operates with more than 1,400 employees across various locations.

Potential impact and risks

The claims made by the Lockbit3 group suggest that the personal data of employees and business partners in Belgium, the Netherlands, the United Kingdom, and Poland may be at risk. The exposure of identity documents, such as passports, could increase the likelihood of identity theft for the affected individuals. Furthermore, as the company operates across the European Union, legal proceedings regarding data protection breaches under the General Data Protection Regulation (GDPR) may be triggered.

Given the historical methods used by the Lockbit group, it is assessed that this data could be utilized for secondary attacks or targeted phishing campaigns. The exposure of the company's operational continuity and trade secrets may create a long-term competitive disadvantage. When sensitive technical drawings and financial statements are leaked, it can undermine the strategic position of a firm in a competitive market.

For organizations operating in complex international sectors, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee training to recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and ensuring strict access controls for sensitive engineering and financial documents can help mitigate the impact of such incidents. As seen in this case, the loss of intellectual property and personal data can result in both legal and competitive consequences that persist long after the initial attack.