Maldegem.be listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: Belgium
• Sector: Government & Defense
• Announcement date: July 27, 2022

Lockbit3 claims data exfiltration against maldegem.be

The entity associated with the domain maldegem.be has been listed on the leak site of the LockBit ransomware group. This announcement, made on July 27, 2022, marks a significant development in the ongoing threat landscape involving high-profile ransomware groups and public sector entities.

The LockBit group has made a data leak claim regarding maldegem.be. The group alleges that data belonging to the institution has been exfiltrated. With the publication of this notice, it is assessed that the institution's digital assets may be at risk. Such claims are a hallmark of modern ransomware operations, where attackers move beyond simple encryption to a method known as double extortion. In a double extortion scheme, threat actors not only encrypt an organization's files to disrupt operations but also steal sensitive data to threaten the victim with public disclosure unless a ransom is paid.

Details of the alleged breach

Regarding the specifics of the incident, the group's announcement remains limited in scope. There is no information or screenshot provided regarding the nature of the leaked or threatened data. The listing does not specify the volume of data involved or the specific files that were targeted during the alleged intrusion.

• No specific data types were identified in the listing.

In many ransomware incidents, the lack of immediate detail from the attacker is a common tactic used to increase pressure on the victim. By creating uncertainty regarding what has been stolen, the threat actor forces the organization to operate under a cloud of ambiguity, making it difficult to assess the immediate impact on privacy or operational security.

Threat actor profile: LockBit3

The LockBit group is a known entity operating since 2019 under the Ransomware-as-a-Service (RaaS) model. In a RaaS model, specialized developers create the ransomware code and infrastructure, while affiliates carry out the actual attacks, sharing the profits. This modular approach allows the group to scale its operations significantly. Although the group's infrastructure was disrupted by international operations in February 2024, it is reported to have resumed its activities.

Ransomware groups like LockBit often target various sectors to maximize their leverage. The persistence of such groups, even after law enforcement interventions, highlights the evolving nature of organized cybercrime. When a group resumes operations after a disruption, it often brings refined tactics and a renewed focus on high-value targets.

Potential risks and sector implications

The potential leakage of the institution's data may lead to sanctions under GDPR, depending on the nature of the data. Because the organization operates in the public sector, a potential data breach may pose secondary risks to citizens. When government or public-facing entities are targeted, the impact often extends beyond the organization itself, potentially affecting the privacy and security of the general population.

Furthermore, it is possible that the leaked data could be utilized for identity theft or targeted phishing attacks. If sensitive personal information is exposed, attackers can use it to craft highly convincing social engineering campaigns, making it difficult for individuals to distinguish between legitimate communications and fraudulent ones. This secondary use of stolen data remains one of the most significant long-term risks following a data breach.

For organizations in the public sector, maintaining robust defensive postures is critical. This includes implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring comprehensive logging and monitoring to detect unauthorized data movement. Given the potential for secondary risks to citizens, the security of public sector digital assets is a matter of significant public interest and national security importance.