Lindostar.it listed on ElDorado ransomware leak site

• Ransomware group: ElDorado
• Country: Italy
• Sector: Technology
• Announcement date: June 6, 2024

ElDorado claims data breach against lindostar.it

The threat actor known as ElDorado has listed the Italian organization lindostar.it on its dedicated leak site. According to the announcement made on June 6, 2024, the group claims to have successfully executed a cyberattack against the entity, alleging a significant data breach. The group's claim suggests that the incident may have occurred as early as December 7, 2023.

In this type of cyberattack, threat actors typically target specific organizations to extract sensitive information. Once the data is exfiltrated, the attackers often use leak sites to pressure the victim into paying a ransom. This method is a hallmark of modern ransomware operations, where the threat of public exposure is used as leverage during negotiations.

Details of the alleged leak

The announcement provided by ElDorado includes specific details regarding the organization's identity and the scale of the alleged theft. The threat actor has shared the company's contact details and physical address information as part of the listing. To facilitate the sale of the stolen information, the group has provided a link to a Tor-based panel where the data can potentially be purchased.

Regarding the specific content of the stolen information, the provided screenshot does not specify the nature of the leaked data. The listing only states the total volume of the data involved. The details provided are as follows:

• Total claimed data size: 2.70 GB

The listing does not specify any particular file types or the specific categories of information contained within the 2.70 GB of data. Consequently, the exact nature of the files remains unknown based on the available information from the leak site.

Potential risks and implications

This alleged breach may pose significant risks to the organization's operational continuity and data privacy. Because the entity is based in Italy, a confirmed breach could lead to legal obligations and administrative penalties under the General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict protocols regarding data protection and must report breaches to the relevant authorities within specific timeframes to avoid heavy fines.

The impact of such a leak extends beyond the organization itself. Customers and employees of the organization may face secondary risks, such as identity theft or targeted phishing attacks. When personal or corporate data is leaked, attackers often use it to craft highly convincing social engineering campaigns, making it difficult for individuals to distinguish between legitimate communications and fraudulent ones.

The attempt to sell the data suggests that the group is employing double extortion tactics. In a double extortion scenario, attackers do not just encrypt a company's systems to disrupt operations; they also steal sensitive data to threaten the victim with public disclosure. This increases the pressure on the organization, as they must worry about both system downtime and the reputational damage caused by a data leak.

While public information regarding the ElDorado group remains limited, their actions follow a pattern seen in many sophisticated ransomware campaigns. For organizations in the technology sector, maintaining robust defensive measures is critical. This includes implementing strong access controls, conducting regular security audits, and ensuring that all software and systems are patched against known vulnerabilities. Furthermore, maintaining comprehensive backups and having a well-defined incident response plan can help mitigate the operational impact of a successful breach.