Lockbit3 ransomware group lists wings.travel on its leak site

• Ransomware group: Lockbit3
• Country: United Kingdom
• Sector: Hospitality
• Announcement date: May 16, 2023

The LockBit3 ransomware group has listed wings.travel on its dedicated leak site, claiming to possess sensitive data belonging to the organization. This announcement marks a significant escalation in the group's targeting of the hospitality and travel management sector.

The claimed ransomware attack

According to the claims made by the LockBit3 group, the organization was targeted in a ransomware attack. The group announced the breach on May 16, 2023, and simultaneously initiated a countdown timer on their leak site. This countdown mechanism is a common tactic used by ransomware groups to pressure victims into meeting ransom demands before the stolen information is released to the public.

The group has alleged that they have successfully exfiltrated data from the organization's systems. While the group has claimed responsibility for the attack, the incident remains a claim made by the threat actor. The screenshots provided by the group as proof of the breach appear to show various documents that are linked to the organization's internal operational processes.

Data involved in the leak

The information released by the threat actor includes documents that appear to be related to the organization's core business functions. Based on the screenshots provided, the leaked content includes various types of sensitive information. The specific data types identified in the leak include:

• Financial statements
• Travel reservation records
• Operational reports

The presence of these documents suggests that the breach may have exposed internal business logic and client-related details. It is important to note that no specific information was provided regarding the total size of the data stolen or the exact number of files compromised during the incident. Furthermore, no specific ransom demand has been disclosed in the current listing.

About wings.travel

Wings is a travel management company that provides complex travel management and support services on a global scale. The organization specializes in developing markets and high-risk destinations, providing specialized support for travelers in these complex environments.

Risk assessment and industry implications

This leak poses a significant risk of exposing sensitive travel and financial data belonging to the organization's clients. Given the specific sector in which the organization operates, the exposure of such data could lead to legal sanctions under strict data protection regulations, such as the General Data Protection Regulation (GDPR).

The information exposed in such breaches might be utilized by malicious actors for various purposes, including identity theft or highly targeted phishing attacks against the organization's customers. When sensitive travel and financial details are leaked, the potential for secondary attacks increases, as criminals can use the stolen context to craft more convincing fraudulent communications.

The LockBit group has been an active presence in the cyber threat landscape since 2019. Despite significant international law enforcement efforts aimed at disrupting their operations, including a major disruption in February 2024, the group has continued to demonstrate a persistent tendency to operate. This resilience highlights the ongoing challenge posed by sophisticated ransomware-as-a-service models.

For organizations operating in the hospitality and travel sectors, such incidents underscore the necessity of robust defensive measures. Common industry practices to mitigate these risks include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular data encryption audits to ensure that even if data is exfiltrated, it remains unusable to unauthorized parties.