LockBit 3.0 ransomware group lists guyer.com.uy on its leak site

• Ransomware group: LockBit 3.0
• Country: Uruguay
• Sector: Professional Services
• Announcement date: August 31, 2023

LockBit 3.0 claims a major breach at Guyer & Regules

The ransomware group known as LockBit 3.0 has announced a significant data breach involving the Uruguayan law firm Guyer & Regules. According to an announcement posted on the group's leak site on August 31, 2023, the threat actors claim to have exfiltrated a massive volume of data from the organization. This claim follows a pattern of double extortion frequently employed by modern ransomware operations, where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage for ransom demands.

In such double extortion schemes, the threat actor typically threatens to publish the stolen data on a public leak site if the victim fails to meet their demands. This tactic significantly increases the pressure on the target, as the exposure of confidential information can lead to severe reputational and legal consequences, regardless of whether the organization can restore its systems from backups.

The group's claims regarding the attack

The threat actors behind the LockBit 3.0 group have provided specific details regarding how they gained access to the firm's network. The group claims that they were able to infiltrate the law firm due to the incompetence of the organization's IT staff. This claim highlights a common vulnerability in many organizations, where human error or insufficient technical oversight provides an entry point for malicious actors.

Following the initial infiltration, the attackers claim to have stolen a large archive of data. The group has stated that this data has already been published on their dedicated leak site. Furthermore, the threat actors have claimed that they intend to sell the full archive of stolen information to the highest bidder on the dark web. While the group has made these claims, the specifics regarding the ransom demand were not provided in the announcement.

Sensitive information allegedly compromised

The scale of the alleged leak is substantial, with the group claiming that approximately 1 TB of data has been stolen. Based on screenshots provided by the attackers, the leaked content includes identity cards and various other documents. The nature of the stolen information is highly sensitive, as it pertains to the core operations of a legal practice. The listing identifies the following types of affected data:

• Client data
• Legal documents
• Employee data

The exposure of such diverse data types—ranging from personal identification to professional legal documentation—presents a multifaceted risk to the organization and the individuals involved.

About Guyer & Regules

Guyer & Regules is a prominent law firm based in Uruguay. The firm provides a wide range of legal solutions to both international and local clients, specializing in corporate law, tax, and consulting services. Given the firm's role in providing high-level legal and consulting services, the sensitivity of the data they handle is inherently high.

Implications and defensive considerations

The scale and nature of this alleged leak may lead to significant operational and reputational damage for the firm. Because the legal services sector handles highly confidential information, a breach of this magnitude could potentially result in legal consequences under GDPR or local data protection regulations. Furthermore, the leaked identity information may facilitate secondary risks, such as targeted phishing campaigns or identity theft, as attackers can use the stolen details to craft highly convincing fraudulent communications.

The group's history suggests that such leaks could be part of a more complex, coordinated operation. For organizations operating in the professional services sector, maintaining robust security postures is critical. Common defensive steps to mitigate such risks include implementing strict access controls, ensuring continuous monitoring of network traffic, and conducting regular security awareness training to address the human element of cybersecurity. Additionally, maintaining offline, immutable backups and adhering to strict data protection frameworks can help reduce the impact of both encryption and exfiltration events.