Lockbit3 ransomware group lists soken-ce.co.jp on its leak site

• Ransomware group: Lockbit3
• Country: Japan
• Sector: Professional Services
• Announcement date: February 9, 2024

LockBit3 claims data breach at Soken Kagaku Group

The LockBit ransomware group has listed the entity associated with the domain soken-ce.co.jp on its leak site. In an announcement posted on February 9, 2024, the group claims to have compromised data belonging to the organization. This listing follows a claimed attack date of January 16, 2024.

Ransomware attacks often involve a tactic known as double extortion, where threat actors not only encrypt an organization's systems but also steal sensitive information. The goal is to pressure the victim into paying a ransom by threatening to publish the stolen data on public leak sites. These sites serve as a platform for cybercriminals to shame their targets and maximize the impact of the breach. In this specific instance, the group's announcement included a countdown timer, a common psychological tactic used to increase pressure on the victim by signaling the imminent publication of the alleged stolen files.

Details of the alleged data theft

The group has provided samples of documents that appear to be related to the organization's business operations. These samples suggest that the breach involves sensitive administrative and commercial information. Based on the available evidence, the following types of data are reportedly involved:

• Financial documents
• Invoices
• Commercial order forms

While the group has published these samples, they have not provided specific information regarding the total size of the data stolen or the exact file count. Furthermore, there is no information available regarding a specific ransom demand or the organization's response to the incident.

About Soken Kagaku Group

Soken Kagaku Group is a Japanese company that has been in operation since 1948. The organization specializes in the development of unique chemical technologies intended for various industrial sectors. Their technological applications serve diverse markets, including the automotive industry, the production of building materials, and the manufacturing of home appliances. The company operates under a vision of being the best in its field, regardless of its size.

Impact and security implications

This alleged data breach may compromise the organization's trade secrets and operational security. The provided samples suggest that the organization's financial records and correspondence with business partners could be at risk of exposure. Because the organization operates within Japan, it may face specific obligations under local data protection regulations regarding the handling and reporting of such incidents.

The threat actor involved, LockBit, is a ransomware-as-a-service (RaaS) group that has been active since 2019. Although its infrastructure was disrupted by international operations in February 2024, it has been reported that the group continues to operate. The leaked data may create secondary risks, such as phishing attacks or corporate espionage, for the organization's customers and business partners.

For organizations in the professional services and chemical technology sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include maintaining offline backups, implementing multi-factor authentication, and conducting regular security audits to identify vulnerabilities. Protecting the integrity of financial records and commercial correspondence is essential to maintaining trust with business partners and avoiding the secondary risks of targeted social engineering or espionage that often follow a data leak.