Excon.cl listed on Lockbit3 ransomware leak site

• Ransomware group: Lockbit3
• Country: Chile
• Sector: Manufacturing
• Announcement date: October 24, 2023

LockBit3 claims data breach at excon.cl

The LockBit ransomware group has officially listed the Chilean organization excon.cl on its dedicated leak site. According to the announcement made on October 24, 2023, the threat actor group claims to have successfully compromised the entity's data. This listing serves as a public notification of the alleged breach, signaling a potential escalation in the cyberattack against the organization.

The group has implemented a countdown mechanism as part of its announcement. This mechanism is a common tactic used by ransomware groups to exert pressure on their targets. By establishing a visible timer, the attackers create a sense of urgency, threatening to release the alleged stolen data to the public if their demands are not met within the specified timeframe. This countdown mechanism is a core component of the group's intimidation strategy.

Details regarding the alleged data compromise

While the listing confirms that the group claims to have access to sensitive information, specific details regarding the nature of the breach remain unavailable. The provided records and screenshots do not disclose the specific content or the exact types of data that have been allegedly compromised during this incident.

The listing names no specific data types or categories of information.

Organizational profile of excon.cl

Constructora Excon S.A. is a construction company based in Chile. The organization specializes in a variety of industrial and civil engineering services, including earthmoving works, construction projects, and mining processes.

Impact assessment and defensive considerations

This alleged action by the LockBit group may negatively impact the operational continuity and commercial reputation of excon.cl. Because the group's past activities suggest they frequently employ double extortion tactics, the organization faces significant risks. Double extortion is a strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly to force payment.

As a company operating in Chile, the nature of the compromised data could trigger legal processes under local data protection regulations. Furthermore, secondary risks associated with such a breach include the potential use of leaked data for identity theft or targeted phishing attacks against the organization or its stakeholders.

For organizations operating in similar sectors, several defensive and reactive steps are generally advisable in the event of a suspected breach:

• Inform stakeholders: It is advisable for the organization to inform its employees and relevant stakeholders regarding the potential data breach risk.
• Review security measures: Organizations should conduct a thorough review of their existing security measures to identify and remediate vulnerabilities.
• Monitor for secondary threats: Given the risk of phishing and identity theft, heightened monitoring of communication channels and user credentials is necessary.

The limited public information regarding the LockBit group makes it difficult to determine the exact scope of the threat, but the use of public leak sites remains a hallmark of their operational model.