Lockbit3 ransomware group lists thalesgroup.com on its leak site

• Ransomware group: Lockbit3
• Country: France
• Sector: Technology
• Announcement date: October 31, 2022

LockBit claims data breach at Thales Group

The LockBit ransomware group has listed thalesgroup.com on its dedicated leak site, claiming to have successfully carried out a data breach against the organization. This announcement, made on October 31, 2022, marks a significant claim by the threat actor group against a major player in the technology sector.

Ransomware leak sites are a common tool used by cybercriminal groups to exert pressure on their victims. In many modern ransomware campaigns, groups employ a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of leaking this stolen information on a public site serves as additional leverage to coerce the victim into paying a ransom. By publishing a target's name on their platform, the group signals to the world that the organization has been compromised, often accompanied by a countdown or a threat to release the data publicly.

Details of the claimed attack

According to the announcement published by the LockBit group on October 31, 2022, the threat actors claim to have gained unauthorized access to the network of thalesgroup.com. The group asserts that they have successfully exfiltrated data from the organization's environment. Following this listing, the group stated that the organization's data may be made public.

Regarding the specific nature of the information involved in this incident, there is no screenshot or detailed information available regarding the nature of the data shared on the leak site. The listing does not specify the volume of files or the specific types of data that were allegedly stolen during the intrusion.

About Thales Group

Thales Group is a French multinational technology company that operates in the fields of aerospace, defense, transportation, and digital security. It develops critical systems, software, and services, providing solutions to defense and civil industries worldwide.

Risk assessment and industry implications

This claim by the LockBit group may pose risks to the organization's operational continuity and data privacy. Depending on the content of the allegedly exfiltrated data, legal processes may be triggered under data protection regulations in the regions where the organization operates, such as the General Data Protection Regulation (GDPR). The potential exposure of this data could lead to secondary risks such as identity theft or targeted phishing attacks for employees and customers.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. Although its infrastructure was disrupted by international operations in February 2024, it has been reported to have resumed its activities. This suggests that the group's attack methods and threat capabilities may continue to evolve over time.

For organizations operating in critical technology and defense sectors, such threats underscore the necessity of robust cybersecurity frameworks. Common defensive steps for organizations facing these risks include implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring comprehensive network segmentation to prevent lateral movement by attackers. Furthermore, maintaining offline, immutable backups is a fundamental strategy to ensure operational continuity in the event of a successful ransomware deployment.