Lockbit3 ransomware group lists sonoco.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Manufacturing
• Announcement date: May 6, 2024

LockBit3 claims compromise of Sonoco.com

The LockBit ransomware group has listed sonoco.com on its dedicated leak site, claiming to have successfully compromised the organization's data. This announcement, which surfaced on May 6, 2024, indicates a targeted attack against the manufacturing entity. The group has publicly announced its involvement through its established leak platform, marking a significant escalation in the threat landscape for the targeted organization.

The claim was made public via the group's leak site, where they have initiated a countdown process. This countdown mechanism is a common tactic used by ransomware collectives to pressure victims by indicating an imminent intention to publish the allegedly stolen information. The presence of such a countdown suggests that the group is actively moving through its extortion phase.

Details of the alleged event

According to the information provided by the threat actor, the group added sonoco.com to its leak platform on May 6, 2024. The group has officially initiated a countdown process, which serves as a signal of their intent to release the organization's data to the public. This announcement was made through the group's specific leak site, which serves as a repository for their victims' information.

Regarding the specific content of the breach, the nature of the compromised or threatened data is not specified in the provided screenshot or registration records. The listing names no specific data types or categories of information that have been targeted or stolen.

About Sonoco Products Company

Sonoco Products Company is an American company that provides diversified consumer packaging, industrial products, and protective packaging solutions. It is known as the world's largest producer of composite cans, tubes, and cores.

Risk assessment and industry implications

This claim by the LockBit group may pose risks to the organization's operational continuity and commercial reputation. Depending on the content of the allegedly compromised data, secondary risks may be observed for the organization's supply chain partners and customers. As a US-based entity, potential data breaches may trigger legal processes under state-level privacy laws and sectoral regulations.

Given LockBit's known methods, it may be assessed that the group tends to employ a double-extortion strategy, threatening to publish data to demand a ransom. In a double-extortion scenario, attackers do not merely encrypt files to disrupt operations but also exfiltrate sensitive information to use as leverage during negotiations. This tactic increases the pressure on organizations to comply with ransom demands to avoid public exposure of proprietary or sensitive data.

The persistence of this threat actor is notable. Although the infrastructure of the group, which has been active since 2019, was disrupted by international operations in February 2024, its subsequent reactivation suggests that the threat persists. This reactivation highlights the resilience of sophisticated ransomware groups even after significant law enforcement interventions.

For organizations operating in the manufacturing sector, such threats underscore the importance of robust cybersecurity frameworks. Protecting against such attacks involves maintaining rigorous backup protocols, implementing strict access controls, and ensuring continuous monitoring of network environments. Furthermore, because manufacturing entities are often integral parts of larger supply chains, a breach in one organization can create cascading risks for partners and customers alike, making comprehensive data protection a critical component of overall supply chain security.