LockBit3 ransomware group lists suninsurance.com.fj on its leak site

• Ransomware group: LockBit3
• Country: Fiji
• Sector: Financial Services
• Announcement date: July 18, 2023

LockBit3 claims responsibility for Sun Insurance Company Limited data breach

The LockBit3 ransomware group has listed Sun Insurance Company Limited, a prominent financial services provider based in Fiji, on its dedicated leak site. According to the announcement made on July 18, 2023, the threat actor group claims to have successfully infiltrated the organization's systems and exfiltrated a significant volume of sensitive information.

The group alleges that it has gained unauthorized access to the company's internal infrastructure, allowing them to acquire a vast array of files. The announcement includes a countdown timer, a common tactic used by ransomware groups to pressure victims into meeting ransom demands before the stolen data is released to the public. While the group claims to have accessed the systems, no specific ransom demand has been disclosed in the current listing.

Details of the alleged data exfiltration

The breach, as claimed by LockBit3, involves a massive amount of data. The group asserts that they have obtained approximately 190 GB of information, consisting of 185,832 files. Based on screenshots provided by the attackers, the stolen content appears to include highly sensitive documentation that could impact various stakeholders of the institution.

The specific types of data identified in the leak include:

• Passport data
• Financial documents
• Confidentiality agreements
• Employee and customer information

The presence of such diverse datasets, ranging from personal identification to internal corporate correspondence, highlights the potential scope of the intrusion. The leaked files reportedly include examples of financial reports, risk and compliance documents, and internal communications, suggesting a deep penetration into the organization's administrative and operational files.

About Sun Insurance Company Limited

SUN Insurance Company Limited is a general insurance company headquartered in Fiji. It holds a unique position in the local market as the only insurance company in Fiji that is both locally owned and operated. The company serves the Fijian population through an extensive and wide-reaching network of branches and agents distributed across the various islands of the country.

Potential impact and risks of the leak

The exposure of the alleged data poses several significant risks to the institution and the individuals involved. For the customers and employees of Sun Insurance Company Limited, the theft of passport data and personal information creates a heightened risk of identity theft. Such information is highly valuable to malicious actors for fraudulent activities and impersonation.

From a corporate perspective, the leak of financial documents and internal correspondence could severely damage the institution's operational processes and its commercial reputation. Furthermore, given the established tactics of the LockBit3 group, the release of this data may lead to secondary fraudulent activities. The group has been active since 2019 and has continued its operations despite the disruption of its infrastructure in February 2024.

In addition to the operational and reputational damage, the institution may face legal obligations and regulatory scrutiny under the data protection regulations of Fiji. For organizations operating within the financial services sector, such incidents underscore the critical importance of robust cybersecurity frameworks. To mitigate such risks, organizations typically focus on implementing multi-factor authentication, maintaining rigorous patch management, conducting regular security audits, and ensuring comprehensive employee training to prevent initial access through phishing or other social engineering vectors.