Lockbit3 claims data breach against hotel-ostella.com

• Ransomware group: Lockbit3
• Country: France
• Sector: Hospitality
• Announcement date: May 9, 2024

Lockbit3 claims data breach against hotel-ostella.com

The Lockbit3 ransomware group has listed the domain hotel-ostella.com on its leak site, claiming to have compromised the institution's data. This announcement, which appeared on the group's platform on May 9, 2024, suggests that the organization has fallen victim to a cyberattack. While the group has claimed the attack occurred on April 28, 2024, the specific details regarding the total volume of stolen data and the exact ransom demand remain unknown.

Details of the alleged intrusion

According to the claims made by the Lockbit3 group, the breach involves various aspects of the organization's operations. The group has provided sample files that purportedly relate to the hotel's core services, including its hotel, SPA, and restaurant operations. By providing these samples, the group aims to demonstrate the validity of their claim to the target organization.

The group has established a deadline for the situation, stating that the data will be published on their leak site if their demands are not met by May 15, 2024. This tactic is a common feature of modern ransomware operations, where attackers use the threat of public data exposure to pressure victims into paying a ransom.

Data types involved in the claim

The screenshots provided by the attackers in their announcement suggest that a variety of sensitive information has been accessed. The leaked content reportedly includes:

• Financial data
• Operational documents
• Identity information

Specifically, the visual evidence shared by the group includes financial statements, operational hotel documents, and even an image of a passport, indicating that highly sensitive personal identity information may be at risk.

Implications and risks of the leak

The claim of a data breach poses significant risks to both the institution and the individuals whose information may have been compromised. The presence of identity documents, such as a passport, significantly increases the likelihood that the affected individuals could be targeted for identity theft. Furthermore, because the institution operates in France, the potential exposure of such data may trigger mandatory data breach notification obligations under the General Data Protection Regulation (GDPR).

Lockbit3 is known for employing double-extortion tactics. In these scenarios, attackers not only encrypt an organization's systems but also steal sensitive data, threatening to leak it to damage the victim's commercial reputation. Such leaks can facilitate secondary attacks, such as targeted phishing campaigns directed at the organization's customers or employees.

Context of the threat actor

The Lockbit group has been active since 2019. Despite facing significant disruptions in February 2024, the group has reportedly resumed its operations. This resurgence highlights the persistent threat posed by sophisticated ransomware groups that continue to target various sectors, including hospitality, to achieve their goals.

Defensive considerations for the hospitality sector

For organizations operating in the hospitality sector, such as hotels and restaurants, protecting sensitive customer and employee data is critical. When faced with the threat of a ransomware leak, organizations often focus on incident response, containment, and assessing the scope of the data exposure. Strengthening defensive postures through regular security audits, implementing strict access controls, and ensuring robust encryption for sensitive documents are standard industry practices to mitigate the impact of such potential breaches.