Lockbit3 claims data breach against ance.org.mx

• Ransomware group: Lockbit3
• Country: Mexico
• Sector: Professional Services
• Announcement date: May 16, 2023

Lockbit3 claims data breach against ance.org.mx

The Lockbit3 ransomware group has officially listed ance.org.mx on its leak site, claiming to have accessed and stolen sensitive information belonging to the organization. According to the announcement, the group intends to publish the allegedly stolen data, and they have already initiated a countdown process to mark the scheduled time for the public disclosure of the information.

Details of the alleged incident

The announcement made by Lockbit3 indicates that the incident occurred on May 16, 2023. The group's listing includes specific details regarding the operations of ance.org.mx, signaling a targeted approach to the victim. This type of activity is characteristic of modern ransomware operations, where threat actors often employ a double extortion tactic. In such scenarios, attackers do not merely encrypt an organization's local systems to disrupt operations; they also exfiltrate sensitive data to use as leverage, threatening to leak the information on a public forum if the ransom demands are not met.

While the group has published a countdown to create psychological pressure on the victim, no specific details were provided regarding the total size of the data stolen or the specific number of files involved. Furthermore, there is no information available regarding a specific ransom demand or the organization's response to the threat.

Data types involved in the leak

Based on the information provided by the threat actor, the leaked content appears to include a variety of sensitive documents. Visual evidence from screenshots provided by the group suggests that the stolen data contains several categories of information that could be highly sensitive to both the organization and the individuals involved. The identified data types include:

• Passport data
• Employee contact information
• Financial statements
• Accounting records

The presence of such diverse data types—ranging from personal identification documents to internal financial records—suggests a broad compromise of the organization's digital environment.

About ance.org.mx

ANCE is a Mexico-based non-profit organization. The entity provides a wide range of specialized services, including inspection, standardization, certification, laboratory, calibration, and training services.

Risk assessment and implications

The alleged leak of this information carries significant risks for the organization and the individuals whose data was compromised. The exposure of passport samples and employee contact information suggests that both the organization's staff and its customers may face heightened risks of identity theft. Such identity theft can lead to long-term fraudulent activities that are difficult for individuals to rectify.

Beyond the personal risks to individuals, the disclosure of financial statements and accounting records could have severe consequences for the organization itself. Such a leak could negatively impact the commercial reputation of ance.org.mx and potentially disrupt its operational processes. Furthermore, the organization may face legal obligations and regulatory scrutiny under Mexican data protection regulations due to the nature of the exposed data.

The group responsible, Lockbit3, is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite law enforcement efforts that resulted in the disruption of its infrastructure in February 2024, the group continues to demonstrate ongoing activity. This persistence highlights the evolving nature of the threat landscape.

The disclosure of such data can also facilitate secondary risks, such as highly targeted phishing attacks, where attackers use the stolen information to gain trust and further penetrate an organization or its partners. To mitigate such risks, organizations in the professional services sector often focus on implementing robust data protection frameworks, enhancing employee training to recognize social engineering, and maintaining strict access controls to sensitive financial and personal records.