Ransomware Attack on The County Group by LockBit 3.0
Ransomware Attack on The County Group by LockBit 3.0
Victim Overview
The County Group, a UK-based insurance broker, fell victim to a cyberattack by LockBit 3.0 ransomware group. The company operates in the insurance sector, providing various insurance products and services to individuals and businesses in a specific county or region. The County Group is known for its focus on "bringing insurance back to the community" by offering a traditional personal service combined with modern and forward-thinking approaches.
Company Size and Standout Features
The County Group has over 300 employees and generates revenue exceeding £100 million in Gross Written Premium (GWP). The company has experienced significant growth through acquisitions and branch expansions, establishing a strong presence in the industry. It is part of Brown & Brown, Inc., one of the world's largest insurance broking businesses.
Attack Overview
LockBit 3.0, a Ransomware-as-a-Service (RaaS) group, targeted The County Group's website, encrypting its data with the intention of extorting a ransom for its release. The attack involved file encryption, modification of filenames, changes to desktop wallpaper, and the deployment of a ransom note on the victim's desktop. LockBit 3.0 is known for its advanced capabilities, including lateral movement through networks and data deletion to cover its tracks.
Ransomware Group Details
LockBit 3.0, also known as LockBit Black, is a new variant of the LockBit ransomware that emerged in 2022. It is considered one of the most dangerous and disruptive ransomware threats currently active. The group operates under a Ransomware-as-a-Service model, recruiting affiliates to expand its reach and target a wide range of organizations globally.
Company Vulnerabilities
The County Group's size, revenue, and industry presence make it an attractive target for threat actors like LockBit 3.0. Its extensive network, client data, and financial transactions could be compromised in a ransomware attack, leading to significant operational and financial disruptions.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!