Daniel Croft and David Hollingworth 
A major hacking group has claimed a cyber attack on a Queensland-based accounting, finance and business advisory group, allegedly having stolen data belonging to the company.
Founded in 1980, Poole Group is a Sunshine Coast-based accounting and business advisory firm that provides services in tax, accounting, superannuation, bookkeeping, HR support, audit services, wealth advisory, property services, audit services and more.
Poole Group was listed on the dark web leak site of the infamous LockBit ransomware group, which has threatened to leak allegedly stolen data according to a countdown timer set to end in just over 10 days, on October 25.
The ransomware gang did not disclose details of the incident, such as what data it allegedly exfiltrated, nor did it list a ransom value.
A spokesperson for the company told Cyber Daily and its sister publication Banking Daily that they were aware of the claims and were investigating the incident.
“The Poole Group is responding to a cyber incident that affected part of its IT environment in recent days. Once detected, we immediately implemented containment measures and engaged external cyber security specialists to support our response and investigation,” the Poole Group said.
“Our investigation remains ongoing, including assessing the nature and scope of the incident. Should we determine that any individuals have been affected, we will contact them directly.
“We have notified the Office of the Australian Information Commissioner, the Australian Cyber Security Centre and the Australian Taxation Office and continue to work closely with these agencies as our investigation and response efforts continue.”
Who is LockBit?
LockBit is a ransomware-as-a-service (RaaS) group that has existed for some time, having gone through several iterations due to global law enforcement takedowns.
The group was founded in September 2019, and soon became the world’s most prolific ransomware group. It uses a double-extortion model, in which the criminal group both encrypts and steals sensitive data, only deleting stolen files and decrypting data if a ransom is paid.
As a RaaS group, LockBit also allows other hackers, or ‘affiliates’, to use its criminal infrastructure and malware to launch attacks, with the ransomware gang keeping a portion of ransoms as a commission.
LockBit is currently at LockBit 5.0, its 5th iteration, as the name suggests; however, it has been comparatively inactive compared to earlier in the decade.
The group has breached a number of major organisations, including Boeing, the UK Royal Mail, a number of US local government and law enforcement agencies, and more.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.