Lockbit3 claims data breach against llombart.de

• Ransomware group: Lockbit3
• Country: Germany
• Sector: Agriculture and Food Production
• Announcement date: July 31, 2023

Lockbit3 lists llombart.de on leak site

The Lockbit3 ransomware group has officially listed the German organization llombart.de on its dedicated leak site. According to the announcement made by the threat actors, the group claims to be in possession of sensitive data belonging to the company. This listing follows a pattern of double extortion frequently utilized by ransomware groups, where stolen information is threatened with public release to pressure victims into meeting ransom demands.

The announcement was posted on July 31, 2023. While the group has claimed responsibility for the intrusion, the incident highlights the ongoing risks faced by companies in the logistics and food production sectors from sophisticated ransomware operations.

Details of the claimed attack

According to the claims made by the Lockbit3 group, the data associated with the breach was uploaded to their leak portal on July 31, 2023. The group asserts that they have successfully gained unauthorized access to various files that are allegedly related to the company's core business operations, specifically focusing on their logistics and marketing activities.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their targets. In these scenarios, the threat actors often claim to have exfiltrated large volumes of data during the initial stages of the attack. By publishing a company's name on these sites, the group aims to damage the victim's reputation and create legal or regulatory pressure through the threat of exposing private information.

Alleged compromised data types

Based on the information provided by the threat actors and the visual evidence presented in screenshots, the following types of data are claimed to have been compromised:

• Passport data
• Identity information
• Corporate file directories

The presence of such sensitive documentation in the hands of malicious actors significantly increases the risk of secondary attacks against the organization and its stakeholders.

About llombart.de

Llombart is a food company based in Germany. The organization provides a variety of services within the food industry, including the import of fruits and vegetables, logistics, marketing, and consulting services. Given its role in the supply chain, the company's operations are integral to the food production and distribution sector.

Risk assessment and organizational implications

The alleged leak of this data may pose a significant risk of exposing the personal information of both employees and customers. Because the organization is based in Germany, this incident could potentially lead to serious data protection violations under the General Data Protection Regulation (GDPR). The exposure of identity documents and corporate directories can create a foundation for various malicious activities, including identity theft and highly targeted phishing attacks.

The Lockbit group is a well-known entity in the cybercrime landscape. They have been tracked since 2019 and are recognized for their ability to continue operations despite international efforts aimed at disrupting their infrastructure. Their persistence makes them a significant threat to organizations globally.

For organizations operating in similar sectors, such incidents underscore the necessity of maintaining robust data security protocols. To mitigate the risks associated with ransomware and data exfiltration, companies typically focus on several defensive strategies. These include implementing strict access controls to limit the scope of potential breaches, maintaining regular and offline backups to ensure business continuity, and conducting comprehensive security awareness training to prevent initial access via phishing. Furthermore, in the event of a suspected breach, it is often necessary for organizations to review their security posture and fulfill legal obligations by notifying the affected parties and relevant regulatory authorities.