ssi-steel.com listed on LockBit 2.0 ransomware leak site

• Ransomware group: LockBit 2.0
• Country: Thailand
• Sector: Manufacturing
• Announcement date: April 19, 2022

LockBit 2.0 claims data exfiltration against ssi-steel.com

The entity associated with ssi-steel.com has been listed on the leak site of the LockBit 2.0 ransomware group. This announcement, which appeared on the group's leak portal as part of their 2022 operations, indicates a significant security incident involving the organization.

According to the claims made by the threat actors, the LockBit 2.0 group gained access to the organization's networks. Following this unauthorized access, the group claims to have performed a data exfiltration. This type of activity is a hallmark of modern ransomware operations, where attackers do not merely encrypt systems but also steal sensitive information to increase their leverage during negotiations.

Details regarding the alleged data breach

Regarding the specific nature of the information involved in this incident, there is no screenshot or detailed information available regarding the nature of the data shared on the leak site. The listing does not specify the volume of data or the specific types of files that were allegedly taken during the attack.

The listing names no specific data types.

About Sahaviriya Steel Industries (SSI)

Sahaviriya Steel Industries (SSI) is the largest producer of hot-rolled steel sheets in Southeast Asia. The company manufactures steel products for various industries, including construction, automotive, and pipe manufacturing.

Risk assessment and industry implications

LockBit 2.0 is a group observed since 2019, known for its RaaS (Ransomware-as-a-Service) model. In this model, developers provide the ransomware code to affiliates who then carry out the attacks, allowing the group to scale its operations significantly. Although the group's infrastructure was disrupted by international operations in February 2024, such historical listings may indicate that data security risks persist for the affected organization.

The potential exfiltration of the organization's data may lead to secondary risks such as the exposure of employee and customer information. This situation could result in compliance issues regarding privacy regulations within the organization's sector. Furthermore, the leaked data might be utilized for identity theft or targeted phishing attacks.

In the manufacturing sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Organizations often face challenges in securing sprawling industrial networks and supply chain integrations. To mitigate these risks, companies typically focus on several defensive pillars:

• Network Segmentation: Dividing networks into smaller segments to prevent lateral movement by attackers.
• Data Loss Prevention: Implementing tools to monitor and block unauthorized transfers of sensitive information.
• Access Management: Enforcing strict identity verification and the principle of least privilege to limit the scope of potential breaches.
• Continuous Monitoring: Maintaining visibility over network traffic to detect anomalous behavior that might indicate an ongoing exfiltration attempt.

The threat of double extortion—where data is both encrypted and stolen—remains a primary concern for industrial entities. Even when law enforcement actions disrupt a specific group's infrastructure, the data stolen during previous campaigns remains a long-term liability for the victimized organizations.