A little-known ransomware gang has claimed responsibility for a cyberattack on the Ohio Lottery that allegedly involved the theft of personally identifiable information.

Officially described as a “cybersecurity event” by Ohio Lottery, the attack occurred on Dec. 24 and affected some systems. The lottery took steps to mitigate the attack, including taking certain systems offline and hiring cybersecurity professionals to assist with an investigation.

Ohio Lottery has neither confirmed nor denied that employee or customer data was impacted, saying only that the investigation is ongoing and that it will notify anyone affected as quickly as possible in compliance with applicable laws.

In an update today, Ohio Lottery told a local media outlet that “while the cybersecurity incident investigation is ongoing, the State wants to reiterate that if any consumer data was compromised, it will take all measures to assist with credit monitoring to protect Ohioans.”

Although tickets for the lottery remain available to purchase, the outward sign of system issues is the lottery restricting sales of some games on its website and mobile app. Additionally, prizes of more than $599 cannot currently be cashed through the mobile app or at “Super Retailer” locations. Winners of prizes worth $600 or more must mail their tickets to the Ohio Lottery Central Office to claim their prize.

That the “cybersecurity incident” remains ongoing and that the lottery took certain systems offline points to a ransomware attack and a new ransomware group has claimed responsibility: DragonForce.

Bleeping Computer reported Wednesday that the DragonForce ransomware gang has claimed on its leaks site that it stole data during the attack. That includes more than 3 million records covering names, addresses, email addresses, winning amounts, Social Security numbers, dates of birth, and records of employees and players. The gang claims that the stolen data totals more than 600 gigabytes.

The notice from the gang references an offer to both decrypt files and delete stolen data, suggesting the gang undertook a double-tap ransomware attack — one where data is both encrypted and stolen to pressure the victim into paying a ransom.

Little is known about DragonForce. It could likely involve a group of hackers who have operated as part of other known ransomware and hacking gangs, such as LockBit, but the group has burst onto the scene with force: Ohio Lottery isn’t its only victim. The group has also attacked Yakult Australia and claims to have hacked two dozen other targets since early December.

Image: DALL-E 3