Lockbit3 ransomware group lists trois-i.com on its leak site

• Ransomware group: Lockbit3
• Country: Luxembourg
• Sector: Professional Services
• Announcement date: June 6, 2023

Lockbit3 claims compromise of Trois I Investissements Industriels Internationaux

The LockBit ransomware group has officially listed the domain trois-i.com on its dedicated leak site. In an announcement made on June 6, 2023, the threat actor group claimed to have compromised the data belonging to Trois I Investissements Industriels Internationaux. This listing serves as a public claim by the ransomware group regarding the successful exfiltration of organizational data.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption phase. The threat of leaking this stolen data on a public forum is used as leverage to coerce the victim into paying a ransom. While the group's claims are presented on their platform, the actual extent of the breach and the validity of the stolen data remain subject to verification.

Details of the alleged data exfiltration

According to the information provided by the LockBit group, the breach involves a variety of sensitive documents and internal information. The group has shared screenshots to support their claims, which allegedly show various types of confidential materials. The specific types of data mentioned in the listing include:

• Passport data
• Bank contracts
• Internal file directories

The presence of such sensitive information suggests a significant breach of confidentiality. When attackers gain access to internal file directories, they can map out the network structure and identify high-value targets within the organization's digital environment. Furthermore, the inclusion of highly personal and financial documentation increases the potential impact of the leak on both the organization and the individuals involved.

About Trois I Investissements Industriels Internationaux

Trois I Investissements Industriels Internationaux is an independent, family-owned holding company that focuses on long-term investments. The organization was established in the late 1990s in London. In 2006, the company moved its headquarters to Luxembourg, where it currently operates.

Risk assessment and organizational implications

The nature of the allegedly leaked data presents several significant risks. The inclusion of personal identification documents, such as passports, suggests that affected individuals may face heightened risks of identity theft. Because the organization is based in Luxembourg, this incident may trigger mandatory data breach notification obligations under the EU General Data Protection Regulation (GDPR), which governs the handling of personal data within the European Union.

Furthermore, the existence of financial data and bank contracts poses secondary risks to the organization's supply chain and its various business partners. The leaked information could potentially be utilized by the threat actors to conduct highly targeted phishing attacks against the organization or its stakeholders. Such attacks often leverage specific, stolen details to appear legitimate, thereby increasing the success rate of the social engineering attempt.

The LockBit group, which is a Ransomware-as-a-Service (RaaS) model, has been monitored by security researchers since 2019. Although their infrastructure was disrupted by an international law enforcement operation in February 2024, reports indicate that the group has since resumed its operations. For organizations in the professional services and investment sectors, maintaining robust defensive measures is critical. This includes implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits to mitigate the risks posed by sophisticated RaaS groups.