Lockbit3 ransomware group lists sogebank.com on its leak site

• Ransomware group: Lockbit3
• Country: Haiti
• Sector: Financial Services
• Announcement date: October 6, 2023

Lockbit3 claims data breach against Sogebank

The Lockbit3 ransomware group has listed data on its leak site, claiming it belongs to the Haiti-based commercial bank, Groupe Sogebank. The group has published an announcement regarding the alleged breach, marking a significant development in the ongoing threat landscape facing financial institutions in the region.

Details of the alleged attack

According to the announcement published on the Lockbit3 leak site on October 6, 2023, the group claims to have targeted Groupe Sogebank. The group asserts that they have obtained a substantial amount of data, specifically claiming a total of 100 GB of information belonging to the bank. While the announcement was made in October, the group claims the attack itself took place on August 15, 2022.

The post provided by the threat actors included various details regarding the institution's operations and its history. To support their claims of a successful exfiltration, the group also shared sample screenshots of the allegedly stolen data. No information was provided regarding a ransom demand or the specific file count involved in the breach.

Data types involved in the leak

The screenshots provided by the group as evidence of the breach contain various sensitive documents. The content of these samples suggests a wide range of information was targeted. The specific types of data identified in the screenshots include:

• Passport data
• Bank slips
• Financial transaction tables
• Contract documents

The presence of such sensitive documentation highlights the potential impact of the breach on the privacy of the institution's clients.

About Sogebank

Sogebank is a Haitian commercial bank that was established in 1986. It operates as a generalist commercial bank, providing a wide range of financial services to both corporate and individual clients.

Risk assessment and implications

The financial nature of the allegedly exfiltrated data may increase the risk of identity theft and fraud for the institution's customers. When sensitive documents such as passports and bank slips are involved, the potential for misuse by malicious actors is elevated. Such an incident involving a commercial bank could potentially lead to a loss of customer trust and operational disruptions.

Given the methods historically employed by the Lockbit group, it is possible that the publication of this data could lead to an increase in secondary attacks or targeted phishing attempts. Ransomware groups often use a double extortion tactic, where they not only encrypt an organization's data but also threaten to leak it to pressure the victim into paying a ransom. Even if a ransom is not paid, the public release of data can be used to fuel further social engineering campaigns against the victims.

Furthermore, the institution may face legal proceedings in accordance with local data protection regulations and banking standards. Organizations in the financial sector typically face rigorous compliance requirements regarding the protection of client data. When a breach is claimed, it often necessitates a comprehensive investigation to determine the scope of the incident and to ensure that all regulatory reporting obligations are met to mitigate legal and reputational damage.