LockBit 2.0 lists trustinnews.pt on leak site

• Ransomware group: LockBit 2.0
• Country: Portugal
• Sector: Retail & E-Commerce
• Announcement date: February 14, 2022

LockBit 2.0 claims access to trustinnews.pt data

The LockBit 2.0 ransomware group has officially announced the listing of the Portuguese organization trustinnews.pt on its dedicated leak site. This announcement, which appeared on February 14, 2022, serves as a claim by the threat actors that they have successfully gained unauthorized access to the organization's internal data environment.

The claim of access was made on the same day the listing was posted. However, it is important to note that since the initial announcement on the leak site, no specific evidence has been provided to confirm a data breach, nor have any specific details regarding ransom demands been released by the group in relation to the organization's systems.

Details regarding the alleged data leak

At this stage of the incident, there is a significant lack of granular information regarding the specific nature of the alleged leaked data. The threat actors have not provided any documentation or visual evidence, such as screenshots, to substantiate the scope of the intrusion or the content of the files they claim to possess.

The listing names no specific data types or files involved in the alleged breach.

Organization profile

Trust in News is a media group based in Portugal. The company operates within the media sector and manages various publishing outlets throughout the country. As a media group, it owns and operates a diverse portfolio of different magazines and publications.

Implications and security considerations

This incident may indicate potential vulnerabilities within the organization's data security processes. If the claims made by LockBit 2.0 are eventually verified, it is possible that customer personal data could be exposed. Such an exposure could potentially lead to legal sanctions under the General Data Protection Regulation (GDPR).

Furthermore, if data is indeed leaked, it could be utilized by malicious actors for secondary attacks. These secondary threats often include identity theft or highly targeted phishing campaigns aimed at individuals or the organization itself. LockBit 2.0 is a group known for employing double extortion tactics in their ransomware operations.

In double extortion schemes, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with public disclosure. This increases the pressure on the organization to comply with ransom demands to prevent the release of stolen data.

For organizations facing such threats, it is advisable to perform necessary breach notifications to relevant authorities and stakeholders. Additionally, a thorough review of the existing security infrastructure is recommended to identify and remediate vulnerabilities that may have been exploited.

General defensive measures for organizations

To mitigate the risks associated with ransomware and data exfiltration, organizations typically focus on several key defensive pillars:

• Robust backup strategies: Maintaining offline or immutable backups ensures that data can be restored without paying a ransom.
• Network segmentation: Limiting lateral movement within a network can prevent attackers from reaching sensitive data repositories.
• Endpoint protection: Implementing advanced monitoring can help detect unauthorized access or suspicious activities early in the kill chain.
• Employee awareness: Training staff to recognize phishing attempts can reduce the likelihood of initial access via social engineering.

As the situation regarding trustinnews.pt remains unverified, continuous monitoring of the threat landscape is essential for organizations operating in the media and retail sectors to defend against evolving ransomware tactics.