nrtw.org targeted in alleged Lockbit3 ransomware data breach

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: November 24, 2023

Lockbit3 claims data breach at nrtw.org

The Lockbit3 ransomware group has published an announcement on its leak site, claiming to have stolen and leaked data belonging to nrtw.org. The incident, which was identified on November 24, 2023, involves allegations of a significant data breach targeting the organization. According to the group's announcement, the breach was discovered on the same day it was reported to their platform.

The group's listing includes a countdown timer, a common tactic used by ransomware operators to pressure victims. This mechanism indicates that the stolen data may be published on the group's leak site if certain conditions are not met. Such tactics are a hallmark of double extortion, a method where attackers not only encrypt an organization's systems but also threaten to release sensitive information to the public to maximize leverage during ransom negotiations.

Details of the alleged data theft

The Lockbit3 group claims to have obtained various categories of information from the institution. While the specific volume of the data and the exact number of files involved have not been disclosed by the group, the types of information identified in the announcement are highly sensitive. The compromised data categories reportedly include:

• Human resources data
• Insurance data
• Legal data
• Passport information

The inclusion of such diverse data types suggests a broad compromise of the organization's internal and client-facing information systems. The presence of identity-linked documents like passport copies and insurance details significantly elevates the severity of the alleged breach.

About the National Right to Work Legal Defense Foundation

The National Right to Work Legal Defense Foundation, operating under the domain nrtw.org, is a nonprofit organization based in the United States. The foundation is dedicated to providing free legal aid to employees whose rights have been violated due to compulsory unionism. Its primary focus is defending the individual rights of employees regarding union membership, serving as a legal resource for those navigating labor-related rights issues.

Risk assessment and implications of the leak

The nature of the allegedly leaked data poses substantial risks to both the institution's employees and its clients. Because the organization operates within the legal sector, the stolen information may contain highly sensitive client data, which could lead to severe privacy violations. The potential for identity theft is a primary concern given the presence of passport copies and insurance information in the claimed dataset.

Furthermore, the publication of this data could increase the risk of secondary attacks. Threat actors often use leaked information to conduct highly targeted phishing attempts or other social engineering attacks against the individuals involved. In the context of a legal defense foundation, the loss of confidentiality regarding legal matters could have long-term consequences for the parties involved in their cases.

Lockbit3 is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite international operations aimed at disrupting their infrastructure, the group has been reported to have resumed its activities following such operations, most notably after an international operation in February 2024. For organizations in the professional services sector, such incidents often trigger legal processes under relevant data protection regulations due to the sensitive nature of the information handled.

To mitigate such risks, organizations typically focus on robust defensive measures. This includes implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, maintaining offline, encrypted backups and implementing strict access controls can help limit the scope of a potential breach and ensure business continuity.