LockBit Ransomware Attack on Town & Forest Accounting UK: Data Breach Details
Incident Date:
July 19, 2024
Overview
Title
LockBit Ransomware Attack on Town & Forest Accounting UK: Data Breach Details
Victim
Town & Forest Accounting UK
Attacker
Lockbit3
Location
First Reported
July 19, 2024
LockBit Ransomware Attack on Town & Forest Accounting UK
Overview of the Attack
Town & Forest Accounting UK, a prominent chartered accountancy firm based in St Albans, Hertfordshire, has fallen victim to a ransomware attack orchestrated by the notorious LockBit group. The attackers have threatened to release the firm's sensitive data on July 17, 2024, and have already posted sample screenshots on their DarkWeb portal as proof of the breach. This incident highlights the increasing threat of ransomware attacks on financial institutions.
About Town & Forest Accounting UK
Town & Forest Accounting UK is a chartered accounting firm that offers a comprehensive range of financial services tailored to meet the diverse needs of businesses and individuals. The firm, which employs between 11 to 50 individuals, prides itself on blending traditional values with a modern approach. Their services include statutory audits, financial statement preparation, tax planning and compliance, bookkeeping, and company secretarial services. The firm is known for its client-centric approach, emphasizing open communication and personalized advice.
Vulnerabilities and Targeting
As a financial institution, Town & Forest Accounting UK holds a significant amount of sensitive data, making it an attractive target for ransomware groups like LockBit. The firm's reliance on digital systems for bookkeeping, financial reporting, and client communication may have exposed vulnerabilities that the attackers exploited. The use of advanced technology, while beneficial for streamlining processes, also necessitates robust cybersecurity measures to protect against sophisticated threats.
About LockBit Ransomware Group
LockBit, also known as LockBit Black, is a highly sophisticated ransomware-as-a-service (RaaS) group that has been active since September 2019. It is responsible for a significant portion of ransomware attacks globally. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files, making it extremely difficult to decrypt without paying the ransom.
Penetration Methods
LockBit is known for exploiting vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. The ransomware also performs a check to avoid executing on systems with languages common to the Commonwealth of Independent States (CIS) region. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) when executed, the use of a unique icon, and changes to the victim's computer wallpaper. The group’s ability to modify its behavior via command-line parameters further complicates detection and mitigation efforts.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.