Lockbit3 claims cyberattack against ende.bo

• Ransomware group: Lockbit3
• Country: Bolivia
• Sector: Energy & Utilities
• Announcement date: April 16, 2025

Lockbit3 lists ende.bo on leak site

The Lockbit3 ransomware group has listed ende.bo on their leak site, alleging a cyberattack against the organization. This announcement follows a pattern of double extortion tactics often employed by ransomware groups, where attackers not only encrypt systems but also threaten to release sensitive information to pressure the victim into paying a ransom.

Details of the alleged attack

According to the announcement made on the group's leak platform on April 16, 2025, the attackers claim to have gained access to the organization's systems on April 4, 2025. The publication of this listing indicates that a process regarding the alleged exfiltration of the organization's data has been initiated by the threat actors.

Ransomware leak sites serve as a public stage for these groups to exert pressure. By listing a target, the group signals to the victim and the public that they hold data that they intend to use as leverage. This method is designed to maximize the reputational damage to the victim, particularly when the target is a high-profile or strategic entity.

Information regarding the leaked data

The listing does not provide specific details regarding the nature of the leaked or threatened data. The provided screenshot contains only a generic ransomware warning text, and no specific information was shared regarding the types of files or the volume of data involved in the alleged breach.

• No specific data types were named in the listing.

In many such incidents, the lack of immediate detail from the attackers is a common occurrence during the early stages of a leak, as the group may be waiting for a ransom negotiation to fail before releasing specific datasets.

About ende.bo

Empresa Nacional de Electricidad (ENDE) is the state-owned national electricity company of Bolivia. As a strategic public entity, it manages electricity generation, transmission, and distribution activities across the country. Due to its role in managing national energy infrastructure, the organization is a critical component of Bolivia's utility sector.

Impact and security considerations

The alleged incident may have a negative impact on the organization's operational continuity. Given that the organization operates in the energy and utilities sector, there is a possibility that the leaked data could include critical infrastructure information or customer data. Such a scenario could complicate the organization's compliance with legal obligations and could lead to secondary risks, such as targeted phishing attacks against the organization or its stakeholders.

The LockBit group is a known entity that has been active since 2019. Despite its infrastructure being disrupted in February 2024, the group has resumed operations. This resilience highlights the ongoing challenge posed by sophisticated ransomware-as-a-service models.

For organizations operating in critical sectors like energy and utilities, maintaining robust security postures is essential. Common defensive steps include implementing strict access controls, maintaining offline backups, and conducting regular security audits. It may be advisable for organizations to review their data security protocols and take necessary precautions against potential leaks to mitigate the impact of such incidents.