Heras UK Targeted by LockBit 3.0 Ransomware
Incident Date:
May 30, 2024
Overview
Title
Heras UK Targeted by LockBit 3.0 Ransomware
Victim
Heras UK
Attacker
Lockbit3
Location
First Reported
May 30, 2024
Ransomware Attack on Heras UK by LockBit 3.0
Company Overview
Heras UK is a leading end-to-end supplier of permanent and mobile perimeter protection solutions. The company specializes in designing, manufacturing, installing, and servicing temporary and permanent perimeter protection solutions for various sectors, including business, community, and industry. Operating in over 24 countries and employing more than 1100 highly skilled experts, Heras UK is recognized as a premium perimeter protection brand in Europe, known for its reliability, commitment, and expertise in meeting customer safety and security needs.
Attack Overview
The LockBit 3.0 ransomware group targeted Heras UK, claiming to have exfiltrated sensitive data including financial private data, customer building schemes, NDAs, GDPR data, salary data, external private audit reports, and other private information. This attack marks the second time in 9 days that Heras UK has been listed as a victim of a ransomware attack, with the previous incident involving the hacking group Medusa demanding a ransom of $1 million.
Ransomware Group Profile
LockBit 3.0 is an evolution of the LockBit ransomware group, operating under a Ransomware-as-a-Service (RaaS) model. Considered one of the most dangerous and disruptive ransomware threats currently active, LockBit 3.0 features advanced capabilities such as file encryption, desktop modifications, and ransom note delivery. The group has been actively recruiting affiliates and targeting a wide range of businesses and critical infrastructure organizations globally.
Company Vulnerabilities
As a company specializing in perimeter protection solutions, Heras UK may have been targeted by threat actors like LockBit 3.0 due to the sensitive nature of the data they handle, including customer building schemes, financial information, and GDPR data. The company's prominence in the industry and extensive operations across multiple countries likely made them an attractive target for ransomware groups seeking to extort valuable information.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.