Regencymedia.com.au listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Country: Australia
• Sector: Professional Services
• Announcement date: March 26, 2024

The Lockbit3 ransomware group has listed regencymedia.com.au on its leak site, claiming to have exfiltrated data from the organization. This announcement, made on March 26, 2024, follows an alleged attack that took place on March 15, 2024. The threat actor has posted the organization's domain on its portal, alleging a significant data breach.

The details of the alleged breach

The LockBit group has added regencymedia.com.au to its leak portal, alleging a data breach. To support their claims, the group has shared sample images that appear to contain various documents related to the organization's operations. These samples include sensitive information that provides a glimpse into the types of data the group claims to have accessed.

The threat actor has established a deadline for the publication of the alleged data. According to the announcement, the group has set a deadline of March 30, 2024, for the release of the data they claim to have stolen. Ransomware groups often use this tactic of setting deadlines to pressure organizations into paying ransoms, a method commonly associated with double extortion strategies where data is both encrypted and stolen.

Data and information involved in the claim

The sample images shared by the attackers provide specific details regarding the nature of the information they claim to have compromised. The content of these samples suggests that the breach involves several categories of sensitive documentation. The information identified in the shared samples includes:

• Financial documents
• Employee contact information
• Insurance policies

The presence of such information, including expense reports and staff lists, indicates that the attackers may have gained access to internal administrative and financial records.

Organization profile

The target of this alleged attack, regencymedia.com.au, is associated with an entity known as Five Mile. Founded in 1991, Five Mile is a publishing company that produces content for children and their families within the Australian book industry. The business was sold by its founder in 2006 and operated under Bonnier Publishing for many years.

Analysis and potential impact

The alleged breach may increase the risk of identity theft and targeted phishing attacks due to the exposure of employee personal information. Furthermore, the shared financial documents could lead to the disclosure of the organization's trade secrets and operational processes. For an organization operating in Australia, this situation may result in legal and administrative sanctions under the Privacy Act.

The LockBit group is a threat actor that has been active since 2019, operating under a Ransomware-as-a-Service (RaaS) model. Although the group's infrastructure was disrupted by international operations in February 2024, it has been observed to have resumed its activities. The potential leak of this data could cause reputational damage and undermine the trust of business partners.

In general, when organizations face such threats, common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. For professional services and publishing entities, protecting intellectual property and sensitive client or employee data is essential to maintaining operational integrity and regulatory compliance.