US. rail and locomotive company Wabtec hit with Lockbit ransomware

US. rail and locomotive company Wabtec Corporation disclosed a data breach after it was hit with Lockbit ransomware attack.

Wabtec Corporation is an American company formed by the merger of the Westinghouse Air Brake Company (WABCO) and MotivePower Industries Corporation in 1999. It manufactures products for locomotives, freight cars and passenger transit vehicles, and builds new locomotives up to 6,000 horsepower.

The company employs approximately 25,000 people and has 50 plants all over the world.

According to a statement published by Wabtec, threat actors breached the company network and infected internal systems as early as March 15th, 2022.

The unusual activity was detected by the company on June 26th, then the rail giant launched an investigation into the security incident.

“The forensic investigation did reveal that certain systems containing sensitive information were subject to unauthorized access, and that a certain amount of data was taken from the Wabtec environment on June 26, 2022. The information was later posted to the threat actor’s leak site. On November 23, 2022, Wabtec, with the assistance of data review specialists, determined that personal information was contained within the impacted files.” reads the announcement published by Wabtec Corporation. “On December 30, 2022, Wabtec began notifying affected individuals, per relevant regulations, with a formal letter, to let them know their data was involved.”

The company never mentioned the nature of the attack in the announcement, it only stated that the forensic investigation revealed that certain systems containing sensitive information were subject to unauthorized access, and that a certain amount of data was exfiltrated on June 26, 2022. The only reference to an extortion attack is the confirmation that the stolen data was later posted to the threat actor’s leak site, which is a site used by ransomware groups and extortion gangs to announce the availability of stolen data from the victims. On November 23, 2022, Wabtec determined that personal information was contained within the files exfiltrated by the attackers.

Compromised information varies by individual and includes a combination of the following data elements: First and Last Name, Date of Birth, Non-US National ID Number, Non-US Social Insurance Number or Fiscal Code, Passport Number, IP Address, Employer Identification Number (EIN), USCIS or Alien Registration Number, NHS (National Health Service) Number (UK), Medical Record/Health Insurance Information, Photograph, Gender/Gender Identity, Salary, Social Security Number (US), Financial Account Information, Payment Card Information, Account Username and Password, Biometric Information, Race/Ethnicity, Criminal Conviction or Offense, Sexual Orientation/Life, Religious Beliefs, Union Affiliation.

In August, the LockBit ransomware group added Wabtec to the list of victims on its Tor leak site and published samples of stolen data as proof of the hack.

At the time, the ransomware gang fixed the deadline on August 20, 2022 and after the failure of an extortion attempt it published the link to the stolen data.

On December 30, 2022, Wabtec started notifying impacted individuals and encouraged t them remain vigilant against incidents of identity theft and fraud by reviewing their financial account statements and credit reports for any anomalies. 

“While there is no indication that any specific information was or will be misused, considering the nature of the incident and of the affected personal data, we cannot rule out that there may be attempts to carry out fraudulent activity.” concludes Wabtec.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Wabtec)