Lockbit3 claims data breach against mpeprevencion.com

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Healthcare
• Announcement date: May 9, 2024

Lockbit3 claims data breach against mpeprevencion.com

The Lockbit3 ransomware group has claimed responsibility for a data breach targeting mpeprevencion.com, an organization operating within the healthcare sector in Spain. According to an announcement made on the group's leak site, the attackers have allegedly exfiltrated sensitive information belonging to the entity.

Details of the alleged attack

The Lockbit3 ransomware group officially listed mpeprevencion.com on its dedicated leak site on May 9, 2024. Through this announcement, the threat actors claim to have successfully gained unauthorized access to the organization's network. The group asserts that this breach occurred as early as March 22, 2024, suggesting that the attackers may have maintained presence within the network for a significant period before the public disclosure.

To support their claims of a successful intrusion, the group provided evidence in the form of screenshots. These screenshots depict various file directories that appear to be related to the organization's internal operations and its specific service offerings in the field of occupational health.

Data types involved in the leak

The evidence provided by the threat actors suggests that the breach involves a variety of sensitive operational and personal records. The screenshots of the file directories indicate that the following types of information may have been compromised:

• Medical surveillance records
• Employee lists
• Administrative contracts
• Biological waste management documents

While the group has provided visual evidence of these directories, no specific information was provided regarding the total volume of data stolen or the exact number of files involved. Furthermore, no specific ransom demand has been disclosed in the announcement.

About mpeprevencion.com

Mpeprevencion.com, known as GRUPO MPE, is an organization based in Spain that has been in operation since 1996. The company specializes in providing occupational health and safety services. Its primary mission involves offering preventive services designed to ensure the safety of workers and to contribute to the reduction of workplace accidents.

Implications and industry context

The potential exposure of this data carries significant risks for both the organization and the individuals involved. For the employees and clients of the organization, the leak may lead to secondary risks, including identity theft and the execution of targeted phishing attacks. Because the organization operates within the healthcare sector, the leaked data may fall under the strict regulatory requirements of the European Union's General Data Protection Regulation (GDPR).

The disclosure of such information can have a detrimental impact on an organization's operational credibility and may result in various regulatory sanctions. Lockbit3 is a known Ransomware-as-a-Service (RaaS) provider that has been active since 2019. Although the group's infrastructure faced significant disruption due to international law enforcement operations in February 2024, reports indicate that the group has since resumed its operations.

In the broader context of cyber threats, ransomware groups often employ double extortion tactics, where they not only encrypt an organization's data but also threaten to leak it publicly to increase pressure for payment. To defend against such threats, organizations in the healthcare and safety sectors typically focus on robust network segmentation, rigorous access controls, and continuous monitoring of their digital environments to detect unauthorized access early.