Lockbit3 claims data breach against brfibra.com

• Ransomware group: Lockbit3
• Country: Brazil
• Sector: Professional Services
• Announcement date: May 9, 2024

LockBit3 claims a data breach at brfibra.com

The LockBit3 ransomware group has listed brfibra.com on its dedicated leak site, alleging that a data breach has occurred at the organization. This announcement, made by the threat actor group, suggests that the institution's digital infrastructure may have been subject to an unauthorized intervention. Such incidents are common in the landscape of modern cybercrime, where ransomware groups utilize leak sites to pressure organizations by threatening to publish sensitive information.

Details of the alleged attack

According to the information published by the LockBit group on its leak platform on May 9, 2024, the group claims to have obtained data from the institution. While the announcement was made in May, the group claims the attack itself took place on March 7, 2024. The threat actors have set a deadline of May 23, 2024, regarding the situation. This type of tactic is a hallmark of double extortion, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage during ransom negotiations.

In double extortion schemes, the threat actor's goal is to create maximum pressure by threatening to release confidential files on public forums or specialized leak sites. This increases the likelihood of the victim paying the ransom to prevent the exposure of proprietary or personal information. While the group has posted information regarding brfibra.com, the specific nature of the breach remains centered on the group's claims and their established timeline.

Data involved in the leak claim

Regarding the specifics of the alleged breach, the announcement does not provide details regarding the nature of the data allegedly leaked. The listing names no specific data types. While the group's post includes a general description of the institution's operations, no information is provided regarding the actual content of the files that may have been taken during the alleged incident.

About brfibra.com

BR.Digital is a technology consulting firm that provides technology solutions and customer-oriented services to businesses. The company offers services aimed at simplifying the digital transformation processes for enterprises. As a professional services provider, the organization plays a role in managing the technological transitions and digital infrastructures of its clients.

Risk assessment and implications

This incident indicates that the institution's digital assets and customer information may be at risk. For institutions operating in Brazil, legal obligations under the LGPD (General Data Protection Law) may arise as a result of such a potential exposure. The legal framework provided by the LGPD governs how personal data must be protected and how breaches must be handled to ensure the privacy and security of individuals.

If the data is disclosed, secondary risks such as identity theft or phishing attacks against employees and customers may emerge. Phishing attacks often follow data breaches, as criminals use stolen information to craft highly convincing fraudulent communications designed to trick individuals into revealing further credentials or financial details. Identity theft remains a significant concern when personal identifiers are leaked into the public domain.

Given the past activities of the LockBit group, it is assessed that the group is in a restructuring phase and continues its operations. This suggests that despite various law enforcement efforts against such groups, they remain active in the threat landscape. Organizations in the professional services sector can take various defensive steps to mitigate these risks, such as implementing robust encryption, maintaining strict access controls, and ensuring regular backups are stored offline to prevent total data loss during an encryption event.