Carnelutti Law Firm listed on losttrust leak site

• Ransomware group: losttrust
• Country: Italy
• Sector: Professional Services
• Announcement date: September 26, 2023

Carnelutti Law Firm targeted by losttrust

The prominent Italy-based law firm Carnelutti Law Firm has reportedly been listed on the leak site of a threat actor known as losttrust. This announcement, made on September 26, 2023, indicates that the organization has been targeted in a cyberattack involving data exfiltration.

In modern cybercrime, ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. The group then threatens to publish this stolen data on a public leak site if a ransom is not paid. This method increases the pressure on the victim by threatening their reputation and legal standing through the exposure of confidential information.

The claims made by losttrust

The losttrust group claims to have successfully obtained data belonging to Carnelutti Law Firm. According to the group's announcement, the incident took place on September 26, 2023. By publishing the firm's name on their dedicated leak site, the threat actors are engaging in extortion activities, using the threat of data disclosure as leverage to demand payment.

While the listing serves as a public warning and a tool for extortion, it is important to note that the details provided by such groups are often limited. The group's specific tactics and the full extent of their capabilities remain uncertain due to the limited amount of publicly available information regarding their operations.

Data and information status

Regarding the specific contents of the alleged breach, there is no screenshot or detailed information available regarding the nature of the leaked or threatened data. The listing does not specify the types of files or the volume of information that has been targeted. Consequently, the listing names no specific data types.

Organization profile

Carnelutti Law Firm is a prominent Italy-based corporate law firm with a strong international orientation. The firm provides specialized legal and tax advisory services to a diverse range of corporate clients, operating within the professional services sector.

Potential risks and industry implications

This incident may pose significant risks to client confidentiality and the sensitive corporate information held by the law firm. For professional service providers, the exposure of client personal data can facilitate identity theft or lead to highly targeted phishing campaigns against both the firm and its clients.

Furthermore, an alleged breach of this nature could lead to regulatory scrutiny under the General Data Protection Regulation (GDPR) regarding the organization's data protection obligations. Given the firm's prominent position in the professional services sector, such an incident could potentially impact their broader supply chain, as clients rely on the security of their legal and tax advisors.

Organizations operating in high-stakes sectors like legal and tax services can take several defensive steps to mitigate these risks. Implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication (MFA) across all remote access points, and maintaining rigorous patch management are standard industry practices. Additionally, regular security awareness training for employees can help defend against the phishing attempts that often follow a data leak. Maintaining offline, immutable backups is also a critical component of a resilient defense against ransomware-related extortion.