Security HQ Offers Insights into Accenture LockBit Hack

Accenture was targeted recently by a strain of ransomware known as LockBit, says Security HQ.

LockBit attacks are known for their ability to encrypt Windows domains by using Active Directory group policies. Once a domain is infected, new group policies are generated by the malware and sent to devices linked to the network. Here, the policies disable the antivirus security, and implement the malware. LockBit ransomware was first observed in September 2019, since then the malware has become significantly advanced, and once ransomware ads were barred on hacking forums, a new leak site was organized to showcase their latest variant, this being LockBit 2.0

Using LockBit 2.0, the attacker claims to have stolen over 6TB of Accenture’s data and is demanding $50M in exchange. LockBit operators claimed to have gained access to Accenture’s network and were preparing to leak files stolen from Accenture’s servers at 17:30:00 GMT. The hack was announced on the leak site, stating that:

“These people are beyond privacy and security. I really hope that their services are better than what I saw as an insider. If you’re interested in buying some databases reach us”

Accenture’s Response

Accenture made a statement on Wednesday, stating that, “Through our security controls and protocols, we identified irregular activity in one of our environments. We immediately contained the matter and isolated the affected servers.”

They went on to say that, “We fully restored our affected systems from backup, and there was no impact on Accenture’s operations, or on our clients’ systems.”

What Next?

Ransomware attacks are increasing by the day. You need to be prepared. Read our whitepaper on Ransomware Controls – SecurityHQ’s Zero Trust x40, for 40 recommendations to help your organisation safeguard against threats, both future and current. Reasonings behind each recommendation, with real-life examples and analysis of recent ransomware threats. And an exploration of “asymmetrical warfare” so that you can prepare yourself, your business, and your people for the increase in ransomware attacks that you will face.