Lockbit3 ransomware group lists solveindustrial.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Manufacturing
• Announcement date: September 29, 2023

Lockbit3 claims data exfiltration against solveindustrial.com

The LockBit3 ransomware group has officially listed solveindustrial.com on its dedicated leak site. According to the group's announcement, they claim to have successfully exfiltrated sensitive data belonging to the organization. This development follows a pattern of activity observed from the group, which has been active since 2019 and has resumed operations despite experiencing operational disruptions in February 2024.

The announcement was made on September 29, 2023, with the group claiming the attack took place on the same day. In their post, the threat actors have threatened to publish the institution's data if their demands are not met. To demonstrate the validity of their claims, the group has provided sample images that allegedly represent the institution's internal commercial documents.

The group is utilizing double extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage. By threatening to release stolen data publicly, the group aims to exert maximum pressure on the victim to pay the ransom. In this specific instance, the group has issued a ransom demand of 250,000 USD.

Details of the alleged data breach

The information provided by the threat actors suggests that the breach involves various types of sensitive business information. Based on the screenshots shared by the group, the stolen content appears to include critical administrative and financial documentation. The leaked images allegedly display several categories of data, including:

• Commercial documents
• Order information
• Bank wire transfer details

The presence of such documents, particularly those containing bank wire transfer instructions and order details, indicates that the breach could impact the integrity of the organization's financial and logistical operations.

About Solve Industrial Motion Group

Solve Industrial Motion Group is a manufacturing company that specializes in the production and supply of power transmission components and industrial-grade bearings. The company operates by combining the product lines of IPTCI, PTI, and LMS to provide a comprehensive catalog of industrial parts. Their offerings include both metric and American standard industrial parts, serving various manufacturing needs through their specialized product lines.

Potential risks and organizational implications

This incident poses significant risks to the institution's operational continuity and commercial confidentiality. The exfiltration of financial and commercial data could create secondary risks that extend beyond the organization itself, potentially impacting its supply chain partners who may rely on the accuracy and security of the information shared with the company.

Because the organization is a US-based entity, the breach may trigger specific legal obligations. Data breach notification requirements under relevant state laws and federal regulations may apply depending on the nature of the compromised information. Furthermore, the use of double extortion tactics by LockBit3 can lead to secondary consequences such as identity theft or highly targeted phishing attacks directed at the institution's customers and employees.

In general, organizations in the manufacturing sector can mitigate such risks by implementing robust security frameworks. This includes maintaining regular offline backups, enforcing multi-factor authentication (MFA) across all systems, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, monitoring network traffic for unusual data exfiltration patterns and implementing strict access controls can help reduce the likelihood of a successful breach or minimize the impact if one occurs.