LockBit3 Ransomware Hits E21C Education Trust: Key Details
Incident Date:
July 25, 2024
Overview
Title
LockBit3 Ransomware Hits E21C Education Trust: Key Details
Victim
E21C Education for the 21st Century Trust
Attacker
Lockbit3
Location
First Reported
July 25, 2024
LockBit Ransomware Attack on E21C Education for the 21st Century Trust
Overview of E21C Education for the 21st Century Trust
E21C Education for the 21st Century Trust is a UK-based educational organization dedicated to transforming educational experiences for children and young people. Established in 2011, the Trust has grown from a single school to eight schools located in Bromley. E21C focuses on holistic education, emphasizing both academic achievement and personal development. The Trust employs between 501 and 1,000 staff members and operates several academies, including Coopers School, which serves students aged 11 to 18.
Details of the Ransomware Attack
On July 25, 2024, E21C Education for the 21st Century Trust fell victim to a ransomware attack orchestrated by the LockBit group. The breach was announced on LockBit's dark web leak site, raising significant concerns about the security of sensitive information within the Trust. The exact size of the data leak remains unknown, but the incident highlights the increasing threat of ransomware attacks on educational institutions.
About LockBit Ransomware Group
LockBit is a highly sophisticated ransomware-as-a-service (RaaS) group active since September 2019. It has become the most active ransomware group, responsible for over one-third of all ransomware attacks in late 2022 and early 2023. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses RSA-2048 and AES-256 encryption algorithms and typically demands payment in Bitcoin.
Penetration and Vulnerabilities
LockBit is designed to exploit vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. It performs a check to avoid executing on systems with languages common to the Commonwealth of Independent States (CIS) region. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) and changes to the victim's computer wallpaper. The ransomware group likely penetrated E21C's systems through these vulnerabilities, underscoring the need for robust cybersecurity measures.
Impact on E21C
The ransomware attack on E21C has raised significant concerns about the security of sensitive information within the Trust. As an organization committed to delivering high-quality education and nurturing the talents of learners and adults, the breach could have far-reaching implications for its operations and reputation. The incident underscores the critical need for educational institutions to implement robust cybersecurity measures to protect against such threats.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.