French security firm ‘Thales’ refutes the alleged LockBit attack

The notorious LockBit ransomware gang claims to have hacked into the IT systems of a French aerospace and security firm ‘Thales’ after leaking 9.5GB of stolen archive files to its leak site. However, the firm had recently denied these claims, stating that they had found no evidence that its systems were breached.

Before the alleged leaking of stolen files from Thales, the ransomware gang first said they demanded ransom from the company, which Thales might have refused.

 

LockBit’s leaked data from the French security firm allegedly included technical and corporate documents.

 

The ransomware group claimed to obtain Thales’ highly sensitive technical and corporate data, including files related to the firm’s operations, accounting files, commercial documents, customer databases, software, and blueprints.

In the earlier reports of this incident, Thales confirmed that a security breach occurred, although it was not on its systems. As clarified by the French security firm, one of the affected systems in the said breach was from a user account of their partner on a collaboration portal, which exposed a limited amount of user data.

Despite the LockBit group’s claims of attacks on the French security firm, Thales restates that their systems remain operational and the confirmed breach on a partner’s user account had not affected their operations.

The firm added that they are working closely with the affected partner and providing them with necessary technical support to minimise and control any potential impact on their stakeholders and customers.

In the first week of November, LockBit also claimed to attack ‘Continental,’ an automotive manufacturing company in Germany. While Continental had initially confirmed suffering from a cyberattack last August, it was only recently when LockBit was revealed to be the group that had launched it.

Since its first spotted activities in 2019, the LockBit ransomware gang has been one of the most active threat groups in the wild that have leaked massive databases from their victimised organisations that refused to pay a ransom.