Cyber Threat Actor: London & Zurich

The threat actor known as L&Z, also operating under the alias London & Zurich, is based in the United Kingdom. Observed activity indicates a focus on compromising payment processing services, as evidenced by an attack on a third‑party provider that handled direct debit collections for a community lottery. The actor’s apparent objective in that incident was financial gain, seeking to obtain personal and banking information from individuals who used direct debit payments. No public reporting links the group to espionage, disruption, or state sponsorship. Consequently, the actor is currently described as a financially motivated cybercriminal operating within the UK.

In November 2023, L&Z launched a cyber attack against the payment processor London & Zurich, which supplied direct debit services for the Havant Borough Community Lottery managed by Gatherwell Limited. The breach exposed data of supporters who had enrolled in direct debit before early November, while those using alternative payment methods remained unaffected. Gatherwell’s own systems were not compromised, indicating the actor’s focus was limited to the third‑party processor. The incident resulted in the theft of personal and financial details that could be used for fraudulent transactions. This event represents the only publicly documented operation attributed to L&Z to date.