Lockbit3 ransomware group lists vertdure.com on its leak site

• Ransomware group: Lockbit3
• Country: Canada
• Sector: Professional Services
• Announcement date: February 28, 2024

LockBit3 claims data breach against Vertdure

The LockBit ransomware group has listed the Canadian company Vertdure on its dedicated leak site, claiming to have successfully compromised the organization's systems. This announcement, made on February 28, 2024, follows an alleged attack that took place on February 15, 2024. The group has indicated its intention to publish the acquired data if their demands are not met, setting a deadline of March 13, 2024, for the organization.

Ransomware groups like LockBit3 frequently utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's files to disrupt operations but also steal sensitive information to use as leverage. By threatening to release private data publicly, the threat actors attempt to pressure the victim into paying a ransom to prevent reputational damage and legal repercussions.

LockBit is a known Ransomware-as-a-Service (RaaS) entity that has been active since 2019. Despite international efforts to disrupt its operations in February 2024, the group has reportedly resumed its activities, continuing to target various organizations globally.

Data types involved in the alleged breach

While the specific volume of data and the exact amount of the ransom demand remain unknown, the group has provided screenshots as evidence of the breach. These samples suggest that the stolen information is highly sensitive, containing documents that could be misused for fraudulent purposes.

The information identified in the shared samples includes:

• Customer contract information
• Customer contact information
• Employee tax and payroll information

The presence of such specific documents, particularly employee tax and payroll records, significantly increases the risk profile of the incident, as these files often contain highly personal identifiers used in identity theft.

Organization profile: Vertdure

Vertdure, formerly known as EagleYard, is a prominent professional services company based in Quebec, Canada. Founded in 1987, the company has established itself as an industry leader in the region. Vertdure specializes in professional landscaping and lawn care services, providing expertise in areas such as lawn health, fertilization, and pest control.

Analysis and potential implications

The alleged breach of Vertdure poses significant secondary risks to both the company's customers and its employees. The exposure of contact details and contract information can lead to targeted phishing attacks, while the theft of payroll and tax documents, such as T4 forms, creates a high risk of identity theft and financial fraud for the individuals involved.

Because the organization operates within Canada, this incident may trigger specific legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA). Such regulations typically require organizations to take immediate steps to secure their data and notify the relevant authorities and affected individuals when a breach occurs.

For organizations in the professional services sector, such incidents underscore the necessity of robust cybersecurity frameworks. To mitigate the impact of such attacks, companies often need to conduct thorough forensic investigations to determine the full scope of a breach. Furthermore, implementing proactive defensive measures—such as multi-factor authentication, regular security audits, and comprehensive employee training—is a standard industry practice to prevent unauthorized access to sensitive client and personnel records.