Lomma Crane & Rigging targeted by Trigona ransomware group

• Ransomware group: Trigona
• Country: United States
• Sector: Professional Services
• Announcement date: January 29, 2024

Trigona ransomware group claims data breach at Lomma Crane & Rigging

The Trigona ransomware group has listed data on its leak site that it claims belongs to Lomma Crane & Rigging. According to the announcement made on January 29, 2024, the group alleges that the breach occurred around January 25, 2024. This incident involves a data leak announcement rather than a simple encryption event, indicating a potential double extortion tactic where sensitive information is threatened with public release.

Details of the alleged attack

The Trigona group has listed various documents allegedly belonging to Lomma Crane & Rigging on its leak portal. In the announcement, the group stated that it is demanding a ransom of 100,000 dollars in exchange for the data in question. It has been observed that documents related to the institution's operational processes have been shared in the post, which highlights the sensitive nature of the information being targeted during such cyberattacks.

Based on the screenshots provided by the threat actors, the leaked content includes a variety of sensitive business and personal documents. The specific items identified in the leak include:

• Quotation forms
• Credit application forms
• Purchase orders
• Driver's licenses

The inclusion of personal identification documents, such as driver's licenses, significantly elevates the severity of the breach, as these items are highly valuable for fraudulent activities.

About Lomma Crane & Rigging

J.F. Lomma, Inc. is an American company providing crane rental, heavy lifting, and logistics solutions for the construction industry. Based in New Jersey, the firm supplies equipment and expertise for large-scale infrastructure and construction projects. As a provider of specialized services for the construction and infrastructure sectors, the company manages complex logistics and heavy machinery operations.

Potential impact and organizational risks

This leak may pose secondary risks such as identity theft and targeted phishing attacks for the organization's customers and employees. When personal documents like driver's licenses are compromised, the risk of identity theft increases, potentially leading to long-term consequences for the individuals involved. Furthermore, the exposure of operational documents can facilitate highly convincing phishing campaigns aimed at business partners or clients.

As the organization is based in the US, the leak may have consequences regarding state-level data protection laws and potential legal obligations. The Trigona group typically adopts the method of creating pressure by leaking corporate data, a common strategy in modern ransomware operations. This situation may create negative impacts on the organization's commercial reputation and its relationships with business partners. It is worth noting that information about this group is limited in the public domain.

In general, ransomware groups use leak sites to exert maximum pressure on victims by threatening to release sensitive data. To defend against such threats, organizations often implement multi-factor authentication, maintain offline backups, and conduct regular security awareness training to prevent initial access through phishing. For companies in the professional services and construction sectors, protecting operational documents and client identification is critical to maintaining commercial trust and complying with regional data protection regulations.