Aguasdoporto.pt listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: Portugal
• Sector: Energy & Utilities
• Announcement date: February 18, 2023

The public utility company Aguas do Porto has been reported to be listed on the LockBit3 ransomware group's leak site. This announcement, which appeared on February 18, 2023, indicates that the organization has been targeted by the group, according to the information provided by the threat actor.

The claimed attack event

The LockBit group has listed the entity aguasdoporto.pt on their leak platform. In the announcement created on February 18, 2023, the group included the company in their list of affected entities. The group's post specifically references the company's water cycle management operations as part of the context for the listing.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion, where they not only encrypt an organization's data but also threaten to release sensitive information publicly if the ransom is not met. This method increases the pressure on the victim by threatening reputational damage and regulatory scrutiny.

Data involved in the listing

Regarding the specifics of the alleged breach, no screenshots or detailed information regarding the nature of the allegedly compromised data have been provided by the group. The listing does not specify the volume of data or the specific types of files that may have been accessed.

• No specific data types were named in the listing.

In many such incidents, organizations face the challenge of determining the scope of a breach without immediate forensic evidence. When a group claims a breach but provides no proof, such as screenshots of directories or file lists, the actual impact remains unverified until a formal investigation is conducted by the affected entity.

About aguasdoporto.pt

Águas do Porto is a municipal water utility company located in Porto, Portugal. The organization is responsible for managing the entire water cycle within its jurisdiction, which includes the critical tasks of water supply and wastewater management.

Analysis and potential implications

This situation may indicate that the organization's operational data or sensitive customer information could be at risk. Given the past activities of the LockBit group, it is possible that the organization may face secondary extortion attempts. Such attempts often involve contacting the organization through different channels to demand additional payments after the initial breach has been identified.

For an entity located within the European Union, data breach notification obligations under the General Data Protection Regulation (GDPR) may arise. These regulations require organizations to report significant breaches to supervisory authorities and, in some cases, to the affected individuals to mitigate potential harm.

Furthermore, as a public utility provider, it could be assessed that the breach might impact supply chain security. Disruptions or data compromises in essential services can have cascading effects on the infrastructure and the community they serve. Organizations in this sector often prioritize the security of their operational technology and supply chain connections to prevent such disruptions.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. Despite international efforts to disrupt their infrastructure, such as those seen in February 2024, it is considered that they may continue their operations. This persistence makes them a significant threat to various sectors globally.