Doprastav.sk listed on LockBit ransomware leak site

• Ransomware group: Lockbit3
• Country: Slovakia
• Sector: Professional Services
• Announcement date: February 13, 2024

LockBit claims ransomware attack against doprastav.sk

The LockBit ransomware group has claimed a ransomware attack against the Slovakian organization doprastav.sk by listing its data on their leak site. The group announced the listing of data they claim to be associated with the organization on February 13, 2024. This announcement is considered part of the double extortion method typically employed by the group against its victims.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat actors then threaten to release this stolen information on public leak sites if the ransom is not paid. This adds significant pressure on the victim, as the threat of a data leak can lead to regulatory penalties, loss of client trust, and reputational damage, even if the organization can restore its systems from backups.

Data involved in the claim

According to the information provided by the threat actor, the leaked data includes various types of sensitive information. The screenshots provided by the group appear to display a list of numerous email addresses that seem to belong to company employees. Additionally, the leak includes samples of documents that appear to be financial or administrative in nature. The specific items identified as being affected include:

• Employee email addresses
• Financial documents

About doprastav.sk

Doprastav is a modern Slovak construction company with over half a century of history. The organization specializes in the construction of all types of buildings and structures. The company provides a wide range of engineering and construction services, which include infrastructure projects, bridges, and industrial facilities.

Analysis and potential implications

This leak may increase the risk of employees being targeted by phishing attacks. The leaked email addresses could be utilized for further sophisticated phishing attempts against corporate networks. When employee contact information is exposed, attackers often use it to craft highly targeted social engineering campaigns, making it more difficult for security filters and employees to distinguish between legitimate and malicious communications.

Given the organization's operations in Slovakia, it may face legal consequences due to data protection obligations under the GDPR. Organizations operating within the European Union must adhere to strict regulations regarding the protection of personal data, and a breach involving employee information can trigger significant regulatory scrutiny and potential fines.

Considering that the LockBit group has been active since 2019 and has continued its operations despite disruptions in February 2024, it is assessed that pressure is being exerted on the organization's operational continuity. The persistence of such groups despite law enforcement actions highlights the ongoing challenge they pose to global digital security. Depending on the nature of the leaked data, secondary fraud risks may be observed in the future.

For organizations in the professional services and construction sectors, maintaining robust security postures is essential. This includes implementing multi-factor authentication, conducting regular employee security awareness training, and ensuring that all software and systems are patched against known vulnerabilities. Furthermore, maintaining an incident response plan and ensuring regular, offline backups can help mitigate the impact of both encryption-based and extortion-based ransomware attacks.