Lockbit3 ransomware group lists topackt.com on its leak site

• Ransomware group: Lockbit3
• Country: Germany
• Sector: Manufacturing
• Announcement date: February 2, 2025

LockBit claims data breach at topackt.com

The LockBit ransomware group has listed the German-based IT service provider topackt.com on its dedicated leak site. According to the announcement made on February 2, 2025, the threat actors claim to have successfully compromised the organization's systems. The group alleges that the attack occurred on January 23, 2025, and resulted in the exfiltration of a massive volume of information.

Ransomware groups often utilize leak sites as a method of double extortion. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data to pressure the victim into paying a ransom. By threatening to publish the stolen information publicly, the attackers aim to maximize the reputational and legal pressure on the target organization.

Details of the alleged exfiltration

The claims made by the LockBit group regarding the scale of the incident are significant. The threat actors allege that they have stolen a total of 3 TB of data from the organization. While the volume of data is substantial, the specific nature of the leaked files has not been explicitly detailed in the announcement. However, based on the services provided by the company, it is considered that information related to school networks and users managed via the DNSX product may be included in the breach.

The listing names no specific data types, but the implications of the claimed theft are broad. The group asserts that the breach affects not only the company itself but also its client base, specifically mentioning that over 70 schools connected to the company's services were impacted by the attack.

About Topackt IT Solutions

Topackt IT Solutions GmbH is an IT service provider based in Germany. The company is recognized for its specialized software solution known as DNSX (Dynamic Network for Schools X). This product is designed to provide central management of machines and users specifically for educational institutions, making the company a critical component in the digital infrastructure of various schools.

Analysis and potential impact

This incident may pose a significant supply chain risk through the IT services provided by the company. Because Topackt IT Solutions provides management software for educational institutions, a compromise of their environment can have downstream effects on the many organizations that rely on their infrastructure. The involvement of school networks could increase the likelihood of student and staff data exposure, potentially leading to secondary risks for those individuals.

As the company operates in Germany, the breach may be subject to investigation by data protection authorities under the General Data Protection Regulation (GDPR). Such regulatory scrutiny often follows incidents involving the potential exposure of personal information. The LockBit group, which has been active since 2019, has demonstrated a high level of resilience, having been able to reorganize its operations despite previous infrastructure disruptions caused by international law enforcement actions.

Given the nature of the services provided by Topackt IT Solutions, the attack has the potential to affect a wide user base. Organizations operating within the IT service and educational sectors can take defensive steps to mitigate such risks. These typically include implementing robust multi-factor authentication, maintaining strict network segmentation to prevent lateral movement, and conducting regular audits of third-party access permissions. Strengthening supply chain security through rigorous vendor risk management is also a critical component for organizations looking to defend against such widespread impact scenarios.