Lockbit2 ransomware group lists intertabak.com on its leak site

• Ransomware group: Lockbit2
• Country: Switzerland
• Sector: Agriculture and Food Production
• Announcement date: May 30, 2022

The LockBit2 ransomware group has listed the Swiss organization intertabak.com on its dedicated leak site. This announcement, made on May 30, 2022, follows the group's claim that they have successfully compromised the organization's data. Such listings on ransomware leak sites are a common tactic used by cybercriminals to pressure victims into paying ransoms through a method known as double extortion, where stolen data is threatened with public release.

The claimed attack and event details

According to the announcement posted on May 30, 2022, the LockBit2 group claims to have breached the network of intertabak.com. The group asserts that they have gained unauthorized access to the organization's internal data. While the claim was made on the same day as the announcement, the incident signifies a potential compromise of the target's digital environment.

Since the date of the initial announcement, it is understood that significant risks to the organization's network security and the integrity of its data may have emerged. When a group like LockBit2 claims a breach, it often implies that they have bypassed security perimeters to access sensitive internal systems. Such incidents can lead to long-term vulnerabilities if the initial entry point is not identified and remediated.

Information regarding the leaked data

At this time, there is no information available regarding the specific nature or types of the data that have allegedly been leaked. The group has not provided any screenshots or specific file lists to substantiate their claims. Consequently, the listing names no specific data types or categories of information.

In many ransomware scenarios, the lack of immediate detail regarding the stolen files is a common occurrence during the early stages of a leak. Attackers often withhold specific details to maintain leverage during negotiations. However, the absence of a provided file count or a specific ransom demand in the current announcement leaves the full scope of the breach unknown.

Organization profile

Intertabak AG is a Swiss-based importer and distributor of tobacco products. The company specializes in the distribution of cigars and other tobacco goods within the Swiss market. As a specialized distributor within the agriculture and food production sector, the company manages complex supply chains and sensitive commercial information to serve the Swiss market.

Implications and industry considerations

This incident indicates that sensitive data belonging to the organization may have been accessed by unauthorized third parties. If a data breach has indeed occurred, secondary risks may arise, including the potential for identity theft or the execution of targeted phishing attacks against the organization's employees and customers. These secondary attacks often leverage the stolen information to gain further access or to defraud individuals.

Risk assessment and defensive posture

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. The group has posed an active threat to various organizations globally, remaining a significant concern until international operations were conducted in 2024. The presence of such a group in a target's ecosystem highlights the persistent nature of modern cyber threats.

For organizations operating in sectors such as food production and distribution, maintaining robust security protocols is essential. Depending on the specific regulatory requirements within the organization's sector, compliance with mandatory data breach notification obligations may be necessary. Organizations facing such threats typically focus on strengthening network monitoring, implementing strict access controls, and ensuring that data integrity is maintained through regular backups and security audits.

• Network security monitoring: Constant vigilance is required to detect unauthorized intrusions.
• Data integrity: Ensuring that data has not been altered by unauthorized parties is a primary concern during a breach.
• Regulatory compliance: Adhering to sector-specific legal requirements regarding data protection and breach reporting.