LockBit 2.0 ransomware group lists atento.com on its leak site

• Ransomware group: LockBit 2.0
• Country: Spain
• Sector: Professional Services
• Announcement date: October 18, 2021

LockBit group claims ransomware attack against Atento

The LockBit ransomware group has officially listed the organization associated with the domain atento.com on its dedicated leak site. This announcement, posted on October 18, 2021, involves a claim of a significant data breach targeting the entity. According to the threat actor, the incident involved a successful intrusion into the organization's digital infrastructure.

The claims made by the LockBit group suggest a sophisticated operation aimed at disrupting the victim's operations. In such ransomware scenarios, threat actors typically employ a double extortion tactic. This method involves not only encrypting the victim's local data to halt business operations but also exfiltrating sensitive information to use as leverage. By threatening to publish stolen data on a public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of confidential information.

Details of the alleged event

The threat actor behind the LockBit 2.0 operation claims to have gained unauthorized access to the networks belonging to the organization. The group alleges that once they had established a presence within the network, they proceeded to encrypt the organization's data. This encryption is a hallmark of ransomware attacks, designed to render essential files inaccessible to the legitimate users and administrators.

The announcement was officially added to the group's leak platform on October 18, 2021. While the group has made these claims, the specific details regarding the method of entry or the exact timeline of the intrusion remain undisclosed by the attackers. The listing serves as a public notification from the group, intended to signal that the target has been compromised and that the attackers have successfully bypassed the organization's security perimeters.

Information regarding exfiltrated data

Despite the claims made by the LockBit group regarding the breach, there is currently no detailed information available regarding the specific nature or the content of the data that was allegedly exfiltrated from the organization's systems. The listing does not provide any screenshots or specific documentation to substantiate the claims of what was stolen.

The listing names no specific data types that were involved in the alleged breach.

About Atento

Atento is a multinational corporation that provides a variety of professional services. The company specializes in customer relationship management and business process outsourcing (BPO) services. Atento is recognized for its expertise in customer experience solutions and maintains a strong operational presence across both Latin American and European markets.

Potential impact and industry implications

This incident, if verified, may lead to a significant disruption of the organization's operational continuity. The encryption of critical systems can halt business processes, leading to service outages for clients. Furthermore, the exposure of sensitive corporate data poses a grave risk. If a breach has occurred, it could result in the misuse of customer or employee data by malicious actors, which may lead to secondary risks such as identity theft.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. This specific claim falls under their LockBit 2.0 operational period, which was active in 2021. Organizations operating in the professional services sector, particularly those handling BPO and customer relationship management, face significant legal obligations under relevant data protection regulations following a breach. A successful attack can lead to a substantial loss of reputation and trust among global clients.

To defend against such threats, organizations typically implement multi-layered security strategies. Common defensive steps include maintaining robust, offline backups to ensure data recovery, implementing strict access controls to limit lateral movement within a network, and conducting regular security audits to identify vulnerabilities. Continuous monitoring of network traffic can also help in detecting unauthorized access before data exfiltration can occur.