LockBit Leaks MoD Contractor Data In “Sophisticated Cyber-Attack”

Elizabeth Greenberg

05 September 2023, 10.42am

The contractor initially claimed that no data had been compromised, but has since admitted that around 10 gigabits of data was leaked by the ransomware gang.

A LockBit ransomware sting has leaked sensitive data from the UK Military of Defence (MoD) contractor Zaun, a West Midlands-based fencing systems manufacturer, in a “sophisticated cyber-attack”.

Zuan, which is contracted with the UK military, first admitted to a cyber incident on 1 September, which took place between 5 and 6 August, but at that time did not think any sensitive data had been accessed or leaked.

According to the company, the breach occurred through a rogue Windows 7 PC that was running software for one of Zuan’s manufacturing machines.

“At the time of the attack, we believed that our cybersecurity software had thwarted any transfer of data,” the company said in a statement.

“However, we can now confirm that during the attack LockBit managed to download some data, possibly limited to the vulnerable PC but with a risk that some data on the server was accessed. It is believed that this is 10 GB of data, 0.74% of our stored data.”

As first reported by the Mirror, the data leaked by LockBit included sales ordered related to UK military sites like the Porton Down in Wiltshire, a research unit, and Scottish nuclear submarine base, Faslane. They also alleged that the breach included data on the equipment used at RAF Waddington and GCHQ’s Bude satellite ground station.

The Daily Mirror even claimed that maps and drawings of perimeter fencing at British army site Cador, were compromised, as well as documents concerning various jails in England.

Zuan however, has denied that the data leaked included sensitive information. The company produces high-security perimeter fencing, and has supplied this to many high profile sites, the company said, but these are in the public domain and are on public display.

Further, their product details are available online for unrestricted purchase – they are not an approved government contractor, and claim that “any member of the public can walk up to our fencing that has been installed at these sites and look at it.”

“As such it is not considered that any additional advantage could be gained from any compromised data beyond that which could be ascertained by going to look at the sites from the public domain,” they said in a statement.

“LockBit will have potentially gained access to some historic emails, orders, drawings and project files, we do not believe that any classified documents were stored on the system or have been compromised,” the statement continued, again denying any sensitive and undisclosed data was revealed in the leak.

LockBit first claimed the attack on 13 August, and gave Zuan 16 days to pay a ransom. Data was then released on LockBit’s leak site after this time, likely due to the ransom going unpaid.

Since then, Zuan has said they have been in touch with the relevant authorities concerning the attack, including the National Cyber Security Centre (NCSC) and the Information Commissioner’s Office (ICO).