Lockbit3 ransomware group lists sterlinghomes.com.au on its leak site

• Ransomware group: Lockbit3
• Country: Australia
• Announcement date: December 22, 2023

LockBit3 claims data breach at Sterling Homes

The LockBit3 ransomware group has listed data allegedly belonging to the Australian construction firm sterlinghomes.com.au on its leak site. This announcement, made on December 22, 2023, follows the group's claim of having successfully breached the organization's digital infrastructure.

According to the claims made by the ransomware group, they gained unauthorized access to the systems of sterlinghomes.com.au and subsequently exfiltrated various sets of data. As part of their public announcement, the group has shared samples of the allegedly stolen information to demonstrate the success of their operation. No information was provided regarding the total size of the data stolen, the specific number of files involved, or a specific ransom demand.

Details of the allegedly stolen data

The information released by the threat actor includes a variety of sensitive details belonging to both employees and business partners of the company. The leaked content is intended to demonstrate the scope of the breach and may include highly personal information used for identity verification or social engineering.

The specific types of data identified in the leak announcement include:

• Full names
• Employee contact information
• Business partner contact information
• Job titles
• Company information
• Locations
• Personal and business email addresses
• Phone numbers
• Social media profiles

The exposure of such details, particularly when combined, significantly increases the risk of identity theft and targeted phishing attacks against the individuals involved. Such attacks often leverage the specific context of the stolen information to appear legitimate to the victim.

About Sterling Homes

Sterling Homes is a South Australian-based residential construction company with over 45 years of experience in the industry. The company specializes in design, customer service, and construction quality, having received numerous industry awards for its contributions to the sector.

Risk assessment and organizational implications

The alleged leak of this data carries significant implications for the affected parties. For the employees and business partners whose information has been exposed, there is a heightened risk of secondary attacks. Given the known tactics of the LockBit group, it is possible that the leaked data could be utilized in subsequent, targeted campaigns designed to exploit the trust established through the stolen business and personal details.

From a regulatory perspective, as an organization operating in Australia, the firm may face data protection obligations under the Privacy Act 1988. This may necessitate the initiation of formal data breach notification processes and the direct informing of all affected parties to mitigate potential harm.

The LockBit group has demonstrated significant resilience, having been active since 2019 and continuing its operations despite international intervention in February 2024. This persistence underscores the necessity for organizations to maintain robust cybersecurity postures. In response to such threats, organizations typically review their cybersecurity measures and implement defensive strategies to protect against the double extortion tactics commonly used by ransomware groups, where data is both encrypted and stolen to maximize leverage over the victim.