ThreeAM ransomware group lists moore-tibbits.co.uk on its leak site

• Ransomware group: ThreeAM
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: February 27, 2024

The ThreeAM ransomware group has listed the United Kingdom-based law firm moore-tibbits.co.uk on its leak site. This announcement, made on February 27, 2024, involves a claim of a data breach against the professional services firm.

The details of the claim

The threat actor known as ThreeAM listed moore-tibbits.co.uk on its leak site on February 27, 2024, alleging a data breach. According to the group's announcement, they claim to have obtained access to various sensitive files belonging to the firm. This includes access to the firm's accounts, administrative, marketing, and case management files.

In the announcement, the group provided a screenshot to support their claims. This screenshot displays various directory structures that suggest the scope of the alleged access. The visible directories include labels such as 'Accounts', 'Admin & Marketing', 'Case Management and precedents', and 'Client Work'. Furthermore, the screenshot indicates that the leak process is currently 20% complete, suggesting that the threat actor may still be in the process of exfiltrating or publishing the stolen information.

Data allegedly involved in the breach

Based on the information provided by the ThreeAM group, the breach allegedly involves several categories of sensitive information. The specific types of data claimed to be affected include:

• Financial records
• Administrative data
• Marketing data
• Case files
• Client work

While the group has provided screenshots of directory structures, no specific information was given regarding the total size of the data or the specific file count involved in this incident. Additionally, no ransom demand has been made public in the provided source.

About Moore & Tibbits

Moore & Tibbits is a well-established law firm based in Warwick, UK, with over 188 years of experience in the legal sector. The firm provides a wide range of legal advisory and representation services to both individual and corporate clients.

Implications and sector risks

This incident suggests that a firm operating in the legal sector may be facing the risk of sensitive client information being exposed. The alleged leak of case files and financial records could create secondary risks for clients, such as identity theft or fraud. Given that the institution is based in the United Kingdom, a potential data breach could lead to legal obligations and regulatory sanctions under the UK GDPR. The nature of the confidential data held by law firms may amplify the impact of such attacks.

Ransomware attacks often involve a tactic known as double extortion, where threat actors not only encrypt an organization's data but also steal sensitive information to use as leverage. By threatening to leak this data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This method is particularly effective against sectors like legal services, where client confidentiality is paramount.

Publicly available information regarding the ThreeAM group remains limited. For organizations in the professional services sector, such incidents highlight the importance of robust cybersecurity measures. Defensive strategies typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.