Lockbit2 ransomware group lists gva-atencia.es on its leak site

• Ransomware group: Lockbit2
• Country: Spain
• Sector: Professional Services
• Announcement date: April 4, 2022

LockBit2 claims data breach at GVA & Atencia

The entity gva-atencia.es has been listed on the leak site of the LockBit ransomware group. This announcement, made by the threat actor group, suggests that the organization's data may have been compromised during a cyberattack.

The LockBit ransomware group listed gva-atencia.es on its leak site on April 4, 2022. The group claims to have obtained data belonging to the entity. However, the listing remains limited in scope, as no information regarding a ransom demand or the volume of the compromised data has been provided in the announcement. The claim of the attack is dated April 4, 2022, coinciding with the date the entity was posted on the leak site.

Details of the claim

Regarding the specifics of the breach, the information available is currently very limited. There is no screenshot available on the leak site, and no detailed information regarding the content of the compromised data has been disclosed by the threat actors. Furthermore, the listing names no specific data types that have been allegedly exfiltrated.

Ransomware groups often utilize leak sites to pressure victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten its public release. This pressure is intended to coerce the victim into paying a ransom to prevent the exposure of confidential files. While the specific mechanics of this case are not detailed in the leak, the presence of the organization on a ransomware leak site is a hallmark of this type of extortion attempt.

Organization profile

GVA & Atencia is a law firm based in Spain, specializing in legal and tax consultancy. The firm provides a wide range of legal services to both individual and corporate clients.

Risk assessment and implications

This incident involves a claim that the entity's data may have been compromised. The exposure of such data could potentially lead to secondary risks for customers and employees, such as identity theft or targeted phishing attacks. Because the organization operates in Spain, the incident may result in legal sanctions and compliance reviews under the GDPR.

The LockBit group is a Ransomware-as-a-Service (RaaS) operation that has been tracked since 2019. It is worth noting that the group faced an international infrastructure disruption in February 2024. For organizations targeted by such groups, the potential fallout extends beyond immediate operational downtime to long-term reputational damage and legal liabilities.

In the professional services sector, which handles highly sensitive legal and financial information, the impact of a data exposure can be profound. To mitigate such risks, organizations typically find it necessary to review their data security protocols and notify the affected parties. Common defensive steps for organizations include implementing robust backup solutions, enforcing multi-factor authentication, and maintaining strict access controls to limit the potential movement of an attacker within a network. Continuous monitoring and incident response planning are also essential components of a modern cybersecurity posture to defend against evolving ransomware threats.