lockbit2 attacks UK Rail Leasing Ltd
Incident Date:
February 4, 2022
Overview
Title
lockbit2 attacks UK Rail Leasing Ltd
Victim
UK Rail Leasing Ltd
Attacker
Lockbit2
Location
First Reported
February 4, 2022
UK Rail Leasing Ltd Suffers Ransomware Attack
UK Rail Leasing Ltd (UKRL), a prominent entity in rail vehicle engineering, modifications, obsolescence management, spares and repairs, maintenance, and servicing, has fallen victim to the ransomware group Lockbit2. The assault was disclosed on the group's dark web leak site, with the victim's website, operational at the time of this report.
Specializing in rail vehicle engineering and maintenance, UKRL boasts a team of highly skilled professionals experienced in servicing most passenger and freight vehicles, including wagons, currently in use. Located in Leicester, UKRL's depot is equipped with a comprehensive workshop and maintenance facility, capable of undertaking all tasks up to Level 4. The company is recognized for its engineering prowess and innovative solutions, alongside its commitment to exceptional customer service, catering to both passenger and freight rail operators.
Despite recent expansions, including a £1.5 million investment in a new locomotive maintenance facility expected to generate 15 new skilled positions by early 2024, UKRL has not been immune to cyber threats, as evidenced by the Lockbit2 ransomware attack. This incident highlights the ongoing need for stringent cybersecurity defenses, especially in the transportation sector where the potential for disruption is significant.
Lockbit2, active since 2020, is notorious for its bold strategies, frequently targeting large organizations and demanding substantial ransoms. The group's portfolio of high-profile attacks includes operations against the Colonial Pipeline and the Irish Health Service Executive, underscoring its threat to global infrastructure.
The attack on UKRL serves as a critical reminder of the cybersecurity imperatives within the transportation industry. As digitalization advances, investing in comprehensive cybersecurity measures is paramount to safeguard against such pervasive threats.
Sources
- UK Rail Leasing - Vehicle Overhaul and Maintenance Services
- Palo Alto Networks Blog: Network Security - https://www.paloaltonetworks.com/blog
- BBC News: Technology - https://www.bbc.co.uk/news/technology
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.