Dive Brief:

• California’s Department of Finance was hit by a cyberattack and multiple state agencies are responding in coordination with the California Cybersecurity Integration Center. The state Office of Emergency Services is investigating the incident and is working to contain the impact and mitigate future vulnerabilities, according to a statement released Monday.
• The LockBit ransomware group listed the state’s finance department on its leak site Monday and claims it stole 76 GB of data from the department, including databases, financial documents, court filings and IT documents, according to Brett Callow, threat analyst at Emsisoft.
• California officials said the attack was proactively identified and “no state funds have been compromised,” but declined to provide further details. 

Dive Insight:

LockBit, a Russia-affiliated ransomware group which has been on a spree of late, set a deadline of Dec. 24 for California’s Department of Finance to meet its ransom demand, according to a screenshot Callow posted on Twitter.

LockBit has attacked at least 1,000 organizations since it first appeared in January 2020, according to the U.S. Justice Department.

NordLocker research published in September found LockBit was the most prolific ransomware group between January 2020 and July 2022, responsible for 855 attacks or 16% of all known cases during the period.

LockBit also claimed responsibility for the June attack on cybersecurity vendor Entrust.

California officials have not identified the threat actors behind the attack nor commented as to the extent of any data loss. The state’s site for the annual budget is currently inaccessible.

“LockBit has falsely claimed attacks on organizations before, so this claim shouldn’t be assumed to be accurate. Nor should it be assumed that any data they did obtain is as described,” Callow said via email.

“The forensic work needed to work out what data was compromised can take weeks, and ransomware actors attempt to use this period of uncertainty to their advantage,” Callow said.

The California Cybersecurity Integration Center includes the state’s Office of Emergency Services, Department of Technology, the California Military Department and the California Highway Patrol.