aeamg.org.br listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Country: Brazil
• Sector: Government & Defense
• Announcement date: April 16, 2025

The LockBit3 ransomware group has posted an announcement on its leak site claiming to have exfiltrated data from aeamg.org.br. This recent listing follows a pattern of extortion frequently utilized by the group to pressure victims.

The alleged cyberattack and claim

According to the announcement posted on the group's leak site on April 16, 2025, LockBit3 claims to have compromised the organization's data. The group states that the underlying cyberattack occurred on March 31, 2025. On the leak page, a countdown timer is displayed, which indicates the potential publication of the stolen data if the group's demands are not met.

Ransomware groups often use these countdown timers as a psychological tactic to create a sense of urgency. This method is a core component of double-extortion tactics, where the threat actor not only encrypts an organization's systems but also threatens to leak sensitive information to the public or its stakeholders. By doing so, the attackers aim to maximize the pressure on the victim to pay the ransom to prevent reputational damage or regulatory consequences.

Data involved in the alleged breach

While the specific volume of data and the total number of files have not been disclosed by the group, screenshots provided by the attackers suggest that the breach involves sensitive documentation. The samples shared by the group include various types of records that may contain personal information belonging to the organization's members or staff.

The types of data mentioned in the leak include:

• Financial statements
• Accounting records
• Personal data

The presence of such documents highlights the risks associated with data exfiltration, as these files often contain the foundational information required for identity theft or highly targeted phishing campaigns. When sensitive financial and personal records are exposed, the impact extends beyond the immediate digital infrastructure to the individuals represented in those documents.

About aeamg.org.br

AEA-MG (Associação dos Eletricitários e Empregados da CEMIG e suas Subsidiárias) is an association representing the employees and retirees of CEMIG, the electric power distribution company in the state of Minas Gerais, Brazil. Founded in 1983, the organization aims to advocate for the social and professional rights of its members.

Analysis and organizational implications

LockBit is a threat actor that has been active since 2019. The group is notably known for its ability to reorganize and continue operations despite various international law enforcement operations aimed at disrupting their infrastructure. This resilience makes them a persistent threat in the cyber landscape.

The alleged breach of aeamg.org.br may pose secondary risks, such as identity theft or targeted phishing campaigns, specifically aimed at the organization's employees and members. Furthermore, under Brazil's LGPD data protection regulations, the organization may face mandatory breach notification requirements due to the sensitive nature of the alleged data. The sensitivity of the information involved could negatively impact the organization's operational security and its overall reputation.

For organizations operating within the government and defense-adjacent sectors, such as professional associations representing public utility employees, maintaining robust cybersecurity posture is critical. Common defensive strategies include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, ensuring compliance with regional data protection laws, such as the LGPD, is essential for managing the legal and reputational risks associated with potential data exposure.