LockBit attack on UK fencing maker Zaun exposed military site documents

Zaun, a fencing systems manufacturer based in Wolverhampton that supplies perimeter security to UK government, defence and utility sites, confirmed in early September 2023 that it had been attacked by the LockBit ransomware group the previous month.

The company said the intrusion took place on August 5 and 6, 2023 and that the attackers entered through a legacy Windows 7 computer running software for one of its manufacturing machines. Zaun said nothing was encrypted, but acknowledged that LockBit had downloaded data, at most about 10 gigabytes, consisting of historic emails, orders, drawings and project files. LockBit claimed the attack on August 13, set a ransom deadline of August 29 and published the material after it passed.

British press reporting said the leaked documents referred to His Majesty's Naval Base Clyde, the Porton Down defence laboratory, a GCHQ communications site at Bude in Cornwall, an army site in Pembrokeshire, and high security prisons including Long Lartin and Whitemoor.

Zaun disputed the significance of the material. It said it did not believe any classified documents had been stored on the affected system, and argued that because its fencing separates the public from a secure asset, little could be inferred that was not already visible from outside the sites. The company notified the West Midlands Regional Cyber Crime Unit, the National Cyber Security Centre and the Information Commissioner's Office.