Lockbit3 claims data breach against cttxpress.com

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Transportation
• Announcement date: May 9, 2024

Lockbit3 claims data breach against cttxpress.com

The LockBit ransomware group has published data on its leak site, claiming it belongs to the Spain-based logistics firm cttxpress.com. This announcement, which surfaced on May 9, 2024, indicates a potential data leak involving the organization's internal files and operational documentation.

Details of the alleged attack

According to the information provided by the threat actor, the LockBit group has listed cttxpress.com on its leak site and released files allegedly associated with the organization. The group has established a deadline for the release of the mentioned data. While the announcement was made on May 9, 2024, the group has claimed the attack occurred on April 29, 2024.

Ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. Such leak sites act as a public gallery for stolen data, intended to damage the victim's reputation and create immense pressure through the threat of public exposure.

Data types involved in the leak

The screenshot associated with the claim displays file lists that suggest a variety of sensitive information has been compromised. The data identified in the listing includes:

• Financial data
• Logistics contracts
• Budget plans

The presence of such documentation suggests that the attackers have targeted the core administrative and operational functions of the company. The specific nature of these files can provide attackers with significant leverage during negotiations.

Organization profile

The target of this alleged attack is cttxpress.com, a firm operating within the transportation sector. The organization is based in Spain.

Impact and industry implications

This leak may lead to the exposure of the organization's operational data and financial planning. For an organization operating in Spain, this situation could result in data breach notification obligations and administrative penalties under the General Data Protection Regulation (GDPR). If information belonging to employees or business partners is included, secondary risks such as identity theft or targeted phishing attacks may be observed.

The LockBit group is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite international operations conducted in February 2024, the group appears to continue its operations. This incident could create negative impacts on the organization's commercial reputation and may weaken supply chain security.

For organizations in the logistics and transportation sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting the supply chain requires not only securing internal assets but also ensuring that business partners and logistics contracts remain confidential to prevent operational disruptions. Defensive strategies often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to mitigate the risk of unauthorized access and data exfiltration. As seen in this case, the exposure of budget plans and contracts can have long-term consequences for commercial trust and regulatory compliance.