Jetboxcargo.com listed on LockBit ransomware leak site

• Ransomware group: Lockbit3
• Country: Costa Rica
• Sector: Transportation
• Announcement date: February 19, 2023

The LockBit ransomware group has listed jetboxcargo.com on its dedicated leak site. According to the announcement, the threat actor claims to have compromised data belonging to the organization, marking a potential security incident for the Costa Rican-based company.

The alleged data breach

The claim made by the LockBit group was published on February 19, 2023. Through this announcement, the threat actors allege that they have successfully exfiltrated data related to the institution's logistics and transportation operations. This type of claim is a common tactic used by ransomware groups to pressure victims into meeting ransom demands.

In many ransomware incidents, threat actors utilize a method known as double extortion. In this scenario, the attackers do not merely encrypt the victim's systems to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to coerce the organization into paying a ransom. While the listing exists, it is important to note that the group's claims are unverified.

Details regarding the leaked information

At this stage of the investigation, there is no screenshot or detailed information available regarding the nature or content of the allegedly leaked data. The listing does not specify the exact types of files or the specific volume of information that has been targeted. Furthermore, no specific information has been provided regarding the total size of the data or the total file count involved in this alleged breach.

The listing names no specific data types or individual files that have been compromised.

About jetboxcargo.com

JetBox is an organization that provides international logistics and cargo transportation services. The company operates routes from the United States to Costa Rica via both air and sea. In addition to its core transportation services, the firm specializes in logistics processes and operates its own customs brokerage agency.

Risk assessment and industry implications

The LockBit group is a known threat actor that has been active since 2019, operating under the Ransomware-as-a-Service (RaaS) model. Although their infrastructure was disrupted by international operations in February 2024, it has been reported that the group has resumed its activities. This claim may pose a risk of exposing logistics data or operational information belonging to the institution's customers.

Because the institution is based in Costa Rica, a potential data breach may lead to legal processes under local data protection regulations. Furthermore, it is possible that the leaked data could be utilized for identity theft or targeted phishing attacks against the organization or its clients. Such attacks often leverage the stolen information to gain further access to networks or to deceive individuals into revealing more sensitive credentials.

For organizations operating within the transportation and logistics sector, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication across all services, maintaining regular offline backups of critical data, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, monitoring network traffic for unusual data exfiltration patterns can help detect potential breaches before large amounts of data are moved off-site.