nbcc.org listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Sector: Professional Services
• Announcement date: July 31, 2023

The Lockbit3 ransomware group has listed nbcc.org on its dedicated leak site, claiming that the organization has been the victim of a significant data breach. According to the announcement made by the threat actor, the group has allegedly compromised a substantial amount of data belonging to the institution.

The claimed attack and event details

On July 31, 2023, the Lockbit group officially listed nbcc.org on its leak site, asserting that they had successfully executed a data breach against the organization. Following the initial announcement, the group initiated a countdown process, a common tactic used by ransomware actors to exert pressure on their targets. This countdown serves as a deadline, with the group threatening to publish the institution's sensitive information publicly if their demands are not met.

The announcement specifically references the institution's professional activities, noting that the alleged theft involves a dataset totaling 220 GB. This claim suggests a wide-scale exfiltration of information from the organization's systems. While the group has posted this information on their leak site, it remains an allegation made by the ransomware actor.

The data allegedly involved in the breach

The details provided in the leak site announcement specify the types of information that the Lockbit group claims to have exfiltrated from nbcc.org. According to the group, the compromised dataset contains sensitive documentation that could impact various stakeholders. The specific types of data mentioned in the claim include:

• Personal data
• Non-disclosure agreements (NDA)

The inclusion of non-disclosure agreements alongside personal information suggests that the breach may involve not only individual details but also sensitive legal and contractual documentation held by the institution.

Analysis and potential implications

The alleged compromise of personal data poses significant secondary risks to the individuals associated with the institution. For the counselors and professionals served by nbcc.org, the exposure of such information could lead to identity theft or make them targets for highly specific, targeted phishing attacks. Because the institution operates within the professional counseling sector, any confirmed breach of this nature could trigger complex legal processes under various relevant data privacy regulations.

Lockbit is a well-known ransomware actor that has been active since 2019. The group has demonstrated resilience in the face of law enforcement, reportedly resuming its operations following international disruption efforts in February 2024. Such high-profile leaks often result in significant reputational damage to the targeted organization and can cause substantial disruptions to their ongoing operational processes.

In the broader context of cybersecurity, this incident highlights the mechanics of double extortion. In these scenarios, ransomware actors do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage, threatening to leak it to damage the victim's reputation or force compliance through the threat of regulatory fines and loss of trust. Organizations facing such threats typically focus on robust data encryption, strict access controls, and comprehensive monitoring to mitigate the risk of exfiltration.