Lockbit3 ransomware group lists stemcor.com on its leak site

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: February 1, 2024

The Lockbit3 ransomware group has listed the organization stemcor.com on its dedicated leak site, alleging that the company has been the victim of a data breach. The announcement, which was published on February 1, 2024, marks a new instance of the group targeting industrial entities. While the group has made this public claim, the breach itself remains an allegation made by the threat actor.

The details of the claim

According to the information provided by the Lockbit3 group, the alleged attack took place on October 30, 2023. In their public listing, the group describes stemcor.com as an independent service provider for the steel industry. Following the initial announcement on February 1, 2024, the group established a deadline of February 21, 2024, presumably to pressure the organization into meeting their demands.

Ransomware leak sites like the one operated by Lockbit3 serve as a platform for cybercriminals to exert pressure on their victims. These sites are used to host announcements and, in many cases, samples of stolen data to demonstrate the success of an intrusion. The use of these platforms is a core component of modern ransomware operations, designed to maximize the visibility of the breach and increase the likelihood of a ransom payment through public shaming.

Data involved in the alleged breach

Regarding the specific details of the incident, there is no information regarding the nature of the allegedly leaked data in the provided record or the associated screenshots. The listing does not specify the types of files, the volume of data, or the specific categories of information that the group claims to have exfiltrated.

About stemcor.com

Stemcor is an independent steel trading company that provides global supply chain management and services for the steel industry. The company offers logistics, financing, and marketing solutions between steel producers and end-users.

Analysis and potential implications

Lockbit is a ransomware group that has been active since 2019. The group has reportedly resumed operations following international disruption efforts in February 2024. This specific incident highlights the ongoing threat posed by such groups, which often employ double extortion tactics. In a double extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information, threatening to publish it online to force a ransom payment.

The implications of such a breach depend heavily on the nature of the data involved. Because the organization is based in the United Kingdom, a potential breach could trigger data breach notification obligations under UK GDPR. Depending on the nature of the alleged data, the exposure of employee or customer information may pose risks for identity theft and targeted phishing attacks. Furthermore, as the organization operates in the manufacturing sector, secondary risks such as operational disruptions or the exposure of trade secrets may also be present.

For organizations operating in critical industrial sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations can help mitigate the impact of potential incidents.