Lockbit3 ransomware group lists spu.ac.th on its leak site

• Ransomware group: Lockbit3
• Country: Thailand
• Sector: Education
• Announcement date: May 9, 2024

The Lockbit3 ransomware group has listed data allegedly belonging to Sripatum University on its dedicated leak site. The announcement, made on May 9, 2024, suggests that the institution's digital infrastructure has been targeted in a cyberattack.

Details of the claimed attack

According to the information provided by the Lockbit3 group, the activity targeting the institution's IT infrastructure may have occurred as early as March 12, 2024. This indicates that the threat actors may have had access to the university's systems for several weeks or even months before the public listing was made.

The group has established a deadline for the incident, stating that the data will be published on May 15, 2024, if their demands are not met. Ransomware groups often use these countdown timers as a psychological tactic to pressure victims into paying ransoms, a method commonly associated with double extortion tactics. In such scenarios, attackers not only encrypt an organization's data but also threaten to release sensitive information publicly to maximize leverage.

Nature of the leaked data

While the group has provided screenshots showing various file directories, there is no detailed breakdown regarding the full scope and nature of the leaked data. The listing does not specify the exact volume of files or the specific types of information contained within the directories shown in the captures.

About Sripatum University

Sripatum University is a private university located in Bangkok, Thailand. It operates with a vision to be an ICT campus focused on developing technology and media for educational purposes.

Analysis and potential impact

Lockbit is a ransomware group that has been active since 2019. Despite facing international disruptions in February 2024, the group has reportedly resumed its operations. This incident involving Sripatum University could lead to the exposure of student and staff records, which potentially results in identity theft or targeted phishing attacks against the affected individuals.

The disclosure of academic and financial records within the university network could negatively impact the institution's operational credibility and may facilitate secondary extortion attempts. Furthermore, under Thailand's data protection legislation (PDPA), the institution may face legal obligations regarding such a breach.

For organizations in the education sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Defensive measures often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular offline backups to ensure data integrity and availability. Additionally, monitoring for unauthorized access to sensitive directories and training staff to recognize phishing attempts are essential steps in mitigating the risks posed by sophisticated ransomware groups.