NCSC statement on law enforcement's disruption of LockBit ransomware operation

Today, law enforcement has taken control of technical infrastructure which underpins the LockBit operation, including its primary platform and leak site where data stolen from victims in ransomware attacks have previously been hosted.

The seizure of the criminal infrastructure aims to reduce the threat to the UK, while data obtained through the campaign will help law enforcement progress their investigations.

Ransomware remains the most significant cyber threat facing UK organisations and they are strongly encouraged to take action to help protect themselves online.

The NCSC has published a range of advice and guidance to help organisations understand, mitigate and respond to ransomware attacks.

Jonathon Ellison, NCSC Director for National Resilience and Future Technology, said:

“We welcome the disruptive action taken by the NCA and its partners against the LockBit ransomware operation, undermining cyber criminals’ ability to inflict harm in the UK and around the world.

“Ransomware is an acute and present danger to UK businesses and the damage that attacks cause can have a significant toll on finances, operations and reputations.

“We urge all organisations to follow the guidance on the NCSC website to help reduce their risk of falling victim and to ensure they are well-prepared to respond effectively if the worst happens.”

Last year, the NCSC warned that LockBit presented the highest ransomware threat to businesses in the UK and that it was almost certainly the most deployed ransomware strain globally.

In September, the NCSC and NCA also published a joint report outlining how the tactics of organised crime groups have evolved in recent years, giving rise to a complex cyber criminal ecosystem which underpins ransomware attacks.

In the event of a cyber incident, organisations are encouraged to report via https://www.gov.uk/report-cyber.