Lockbit3 ransomware group lists starplast.ft on its leak site

• Ransomware group: Lockbit3
• Country: France
• Sector: Manufacturing
• Announcement date: October 9, 2023

The Lockbit3 ransomware group has officially listed the manufacturing company Starplast on its dedicated leak site. Through this announcement, the threat actor group claims it will proceed to publish the organization's data, marking a significant escalation in their targeting of the firm.

The details of the claim

On October 9, 2023, the Lockbit group added Starplast to its leak platform. Following the listing, the group initiated a countdown timer, a common tactic used by ransomware operators to exert psychological pressure on their victims. This countdown serves as a deadline, threatening the release of the organization's information if specific demands are not met.

The announcement provided by the group includes general information regarding the company's operations. However, the group has not provided any specific details regarding the nature of the leaked or threatened data. While the threat of publication remains active, the exact content of the data remains unknown at this time.

The organization involved

Starplast is a manufacturing company that specializes in plastic injection and thermoforming technologies. The company has been operating under the Vitalo Group since 2020. Headquartered in Limoges, France, the organization plays a role in the industrial manufacturing sector through its specialized technological processes.

Risk assessment and implications

The listing of Starplast by a known ransomware group carries several significant risks. Because the organization is based in France, a potential data breach may result in legal obligations under the General Data Protection Regulation (GDPR). Such regulatory frameworks impose strict requirements on how companies manage and protect personal information.

The publication of data could lead to the exposure of trade secrets, which are vital to the company's competitive standing in the manufacturing industry. Furthermore, there is a high risk that the personal information of employees or business partners could be compromised. Secondary risks associated with such leaks include the potential use of stolen data for identity theft or the execution of targeted phishing attacks against the organization's contacts.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. Although the group's infrastructure was disrupted by international operations in February 2024, reports indicate that the group has since resumed its activities. This resilience highlights the ongoing threat posed by sophisticated RaaS models.

General defensive considerations

In the context of modern ransomware attacks, organizations often face the threat of double extortion. This method involves not only encrypting a company's files to disrupt operations but also stealing sensitive data to use as leverage for extortion. To defend against such threats, organizations typically implement multi-layered security strategies. These include maintaining offline, immutable backups to ensure data recovery and implementing strict access controls to limit the movement of attackers within a network. Additionally, continuous monitoring and employee training are essential components in reducing the likelihood of a successful breach.