LockBit joins Play ransomware gang in claiming credit for a cyber attack on the City of Oakland

The notorious LockBit ransomware gang this week claimed responsibility for a cyber attack on the City of Oakland and has threatened to publish the data stolen from the city on the dark web.

The City of Oakland suffered a ransomware attack on February 8 that resulted in a network outage and forced it to take several non-emergency systems offline. The city declared a local state of emergency for a week as the ransomware attack forced it to take all its IT systems offline and hampered local government operations.

Interim City Administrator G. Harold Duffey said that Oakland experienced a massive network outage that affected several non-emergency systems, including phone lines within the city. Many systems remained offline for several days while the city took steps to contain the attack.

On March 1, the infamous Play ransomware gang listed the city as a victim on its extortion site and threatened to make the documents public unless a ransom was paid. According to the threat actors, the stolen documents included private and sensitive information, financial and official records, identity documents, passports, individual employee data, and even information purportedly demonstrating human rights violations.

The notorious LockBit ransomware gang joined the party this week, stating that it listed the City of Oakland as a victim on its data leak site. The threat group said in a post that the city has been given a deadline of April 10 to meet its demands, failing which it will publicly leak the allegedly stolen data.

Lockbit is known to falsely claim its victims and list them on its data leak site. Earlier, the gang claimed to have infiltrated the network of leading cyber security company Mandiant and gained access to confidential data.

Soon after LockBit’s claims became public, Mandiant said that it was aware of these claims and was looking into the matter. However, there was no evidence to indicate that the company suffered a security breach.

Mark Karayan, Mandiant’s Senior Manager for Marketing Communications, said, “Mandiant is aware of these LockBit-associated claims. At this point, we do not have any evidence to support their claims.”