Lockbit3 claims data breach against lafase.cl

• Ransomware group: Lockbit3
• Country: France
• Sector: Education
• Announcement date: November 2, 2023

The Lockbit3 ransomware group has listed data belonging to the Alianza Francesa School (lafase.cl) on its leak site. The group has claimed responsibility for the attack, asserting that they have accessed and intended to publish sensitive information belonging to the institution.

The details of the claim

On November 2, 2023, the Lockbit group added lafase.cl to its leak site, claiming that it would publish the institution's data. To support their claim of a successful breach, the group provided various documents related to the school's educational activities as proof. This incident follows a pattern of activity from the Lockbit group, which has been active since 2019 and whose infrastructure was disrupted in February 2024.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on victims. By hosting stolen data on public or semi-public domains, these groups attempt to coerce organizations into paying ransoms to prevent the release of sensitive information. This tactic is often part of a broader strategy used by modern ransomware operators to maximize their leverage over a target.

Data allegedly involved in the breach

Based on the information provided by the threat actor, the leaked content includes various administrative and financial documents. The group has shared screenshots to demonstrate the nature of the information they have acquired. The specific types of data mentioned in the listing include:

• Student certificates
• Administrative documents
• Financial tables

While the group has provided screenshots as evidence, no specific information was given regarding the total size of the data or the exact file count. Furthermore, no ransom demand has been disclosed in the current listing.

About the affected organization

The Alianza Francesa - Antoine de Saint Exupéry, located in Santiago, is an international, multilingual, and diverse educational institution. It is a school that aims to educate individuals with a critical spirit who are committed to their environment.

Analysis and potential impact

The allegedly leaked data may pose risks such as identity theft or targeted phishing attacks for students and staff. Given the sensitive nature of student certificates and administrative documents, the exposure of such information can lead to significant privacy concerns for the individuals involved. Furthermore, because the institution is based in the European Union, it is considered that the breach may lead to data protection violations under GDPR.

The use of double-extortion tactics by the Lockbit group is evident in this case. Double extortion involves both encrypting an organization's data and stealing it, allowing the attackers to threaten the release of the data if the ransom is not paid. This method is designed to increase the pressure on an institution's operational processes and reputation.

Attacks on educational institutions can have negative impacts on individuals due to the exposure of sensitive personal data. To defend against such threats, organizations in the education sector often implement various security measures. These include robust data encryption, multi-factor authentication, regular security audits, and comprehensive employee training to recognize phishing attempts. Maintaining strict access controls and ensuring regular backups of critical administrative and financial data are also essential components of a modern cybersecurity posture.