Lockbit3 ransomware group lists twt.co.za on its leak site

• Ransomware group: Lockbit3
• Country: South Africa
• Sector: Transportation
• Announcement date: January 10, 2024

Lockbit3 claims data breach at Tiger Wheel & Tyre

The Lockbit3 ransomware group has listed the South African organization Tiger Wheel & Tyre on its leak site, claiming a significant data breach has occurred. According to the announcement made on January 10, 2024, the threat actor group alleges that they have successfully exfiltrated a massive volume of information from the company's internal systems.

The group claims to have stolen 867 GB of data during the attack. Furthermore, the announcement suggests that the scope of the breach may extend beyond the primary domain, as the group indicates that data associated with yokohama.co.za and tyresandmore.com is also included in the leaked dataset. This type of claim is characteristic of modern ransomware operations, where attackers use the threat of public disclosure to pressure victims.

Details of the alleged data exfiltration

While the specific contents of the files are often difficult to verify immediately following an announcement, the Lockbit3 group has provided a description of the types of sensitive information they claim to possess. The alleged leak involves a wide array of documents that could pose significant risks to both the organization and the individuals involved.

The data reportedly stolen includes the following types of information:

• Bank documents
• Loan documents
• Contracts
• Passports
• Non-disclosure agreements (NDAs)
• Employee work papers

The presence of such sensitive documentation, particularly identity documents like passports and financial records, significantly heightens the risk of secondary exploitation. In many ransomware scenarios, attackers utilize a technique known as double extortion, where they not only encrypt the victim's local systems but also threaten to publish sensitive data on a public leak site to maximize leverage during ransom negotiations.

About Tiger Wheel & Tyre

Tiger Wheel & Tyre is a prominent retail chain operating in South Africa. The company specializes in the sale and fitment of automotive tyres, wheels, and batteries, serving a broad customer base within the transportation and automotive service sector.

Security implications and risks

The alleged disclosure of this data by the Lockbit3 group carries serious implications for the organization and its stakeholders. The exposure of highly sensitive information, such as passports and banking details, may significantly increase the risk of identity theft and financial fraud for the organization's employees and customers. Such data can be leveraged by malicious actors to conduct highly targeted phishing attacks or other forms of social engineering.

From a regulatory perspective, the organization may face legal consequences under South Africa's Protection of Personal Information Act (POPIA) regarding its data security obligations. Furthermore, the disclosure of this information may create secondary security risks for the organization's various supply chain partners, who may also be vulnerable to downstream attacks stemming from this breach.

Lockbit3 is a ransomware-as-a-service (RaaS) group that has been active since 2019. Despite international efforts to disrupt its infrastructure in February 2024, the group appears to continue its operations. For organizations in the transportation and retail sectors, maintaining robust defensive measures is critical. This typically includes implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, ensuring strong encryption for data at rest and in transit can help mitigate the impact of a potential exfiltration event.