Lexco targeted by meow ransomware group in alleged data breach

• Ransomware group: meow
• Country: Chile
• Sector: Financial Services
• Announcement date: November 7, 2024

Meow ransomware group claims to have stolen data from Lexco

The threat actor known as meow has listed the Chilean company Lexco on its dedicated leak site. According to the claims made by the group, the organization has been targeted in a cyberattack resulting in the exfiltration of a significant volume of sensitive information. The group asserts that they have successfully stolen a data package totaling 28 GB, which they are now offering for sale on the dark web.

The announcement regarding this breach was made on November 7, 2024. The threat actor claims that the attack itself occurred on the same day the listing was posted. At this time, public information regarding the specific identity or technical capabilities of the meow group remains limited. The group has employed double extortion tactics, a method where attackers not only encrypt an organization's systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. In this instance, the group is attempting to sell the alleged data to multiple buyers or a single buyer, setting specific ransom demands for each scenario.

Details of the alleged data theft

The data package claimed by the meow group is described as containing a wide array of operational and personal records belonging to the company. The alleged contents of the 28 GB leak include highly sensitive documentation that could impact various stakeholders. The specific types of data mentioned in the claim include:

• Employee personal data
• Passport scans
• Driver's license scans
• Client contact information
• Service agreements
• Commercial contracts
• Insurance policies
• Financial documents
• Medical records

The presence of such diverse data types suggests that the breach, if confirmed, would touch upon nearly every critical aspect of the company's administrative and client-facing operations.

About Lexco

Lexco is a debt collection company based in Chile. The organization provides legal and extrajudicial debt management solutions to a variety of clients. Their service portfolio covers both corporate and individual clients across several different sectors, including healthcare, finance, automotive, and real estate.

Potential impact and industry implications

The sensitivity of the data allegedly stolen poses a high risk of identity theft and fraud for both the employees of the institution and its clients. Because the alleged leak includes identity documents like passport and driver's license scans, as well as medical and financial records, the exposure directly threatens individual privacy. Such information is highly valuable to malicious actors and could facilitate targeted phishing campaigns designed to conduct secondary attacks against the individuals involved.

Furthermore, the company may face significant legal repercussions under Chilean data protection regulations due to the nature of the exposed information. The use of double extortion tactics by the meow group can have a devastating impact on an organization's operational continuity and its overall reputation within the market.

For organizations operating within the financial services and debt management sectors, such incidents highlight the critical importance of robust data protection frameworks. To mitigate the risks associated with such breaches, companies typically focus on implementing strong access controls, continuous monitoring of network traffic, and comprehensive encryption for data at rest and in transit. Additionally, maintaining a rigorous incident response plan and conducting regular security awareness training for employees are standard defensive steps to help protect sensitive client and corporate information from evolving ransomware threats.