degregoris.com targeted by Lockbit3 ransomware group

• Ransomware group: Lockbit3
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: November 2, 2023

Lockbit3 claims data breach at degregoris.com

The Lockbit3 ransomware group has listed degregoris.com on its leak site, alleging that the organization has suffered a data breach. According to the announcement made on November 2, 2023, the threat actor group claims to have obtained sensitive data belonging to the company. The group has reportedly initiated a countdown process regarding the publication of these files, a common tactic used to pressure victims into meeting ransom demands.

The announcement provided by the group includes various details regarding the company's operations and includes several sample documents to support their claims. This method is a hallmark of modern ransomware operations, where attackers attempt to prove the legitimacy of a breach by providing evidence of the stolen information to the public or the victim.

Details of the alleged data theft

While the specific volume of data and the exact number of files have not been disclosed by the group, the provided screenshots offer insight into the nature of the information involved. The evidence presented in the leak site listing includes various types of sensitive documentation. The content appears to consist of financial correspondence and documents that resemble invoices.

The leaked information is said to include the following types of data:

• Financial documents
• Customer data
• Supplier information

The presence of such documents suggests that the breach may impact the administrative and transactional integrity of the organization's business relationships.

About degregoris.com

De Gregoris is a family-owned company that has been operating within the retail sector since the mid-1990s. The organization is based in the province of Latina, Italy. As a long-standing entity in the retail and e-commerce space, the company maintains various business connections essential to its operations.

Implications and potential risks

The Lockbit3 group is a known Ransomware-as-a-Service (RaaS) provider that has been active since 2019. Their tactics suggest a reliance on double extortion strategies, a method where attackers not only encrypt an organization's data but also threaten to leak it publicly to maximize leverage over the victim.

Because the organization is based in Italy, the leaked data may fall under the scope of the European Union's General Data Protection Regulation (GDPR). The publication of such data can lead to significant secondary risks. For the company's customers and business partners, the exposure of personal and professional information could lead to identity theft or targeted phishing attacks.

Furthermore, such leaks can result in severe consequences for the organization, including damage to its commercial reputation and the potential for legal sanctions. For companies operating in the retail and e-commerce sectors, maintaining robust cybersecurity postures is critical to protecting sensitive customer and supplier information from these types of sophisticated threats.

General defensive considerations

In the face of such threats, organizations often focus on implementing layered security measures. This typically includes maintaining regular, offline backups of critical data, implementing multi-factor authentication across all systems, and conducting regular security awareness training for employees to recognize phishing attempts. Monitoring network traffic for unusual activity and ensuring all software is patched against known vulnerabilities are also standard practices to mitigate the risk of ransomware infiltration.