Lockbit3 claims data breach against totto.com

• Ransomware group: Lockbit3
• Country: Colombia
• Sector: Professional Services
• Announcement date: May 9, 2024

Lockbit3 claims data exfiltration against Nalsani SAS

The LockBit ransomware group has listed the domain totto.com on its dedicated leak site, claiming to have successfully exfiltrated data from the organization. This announcement, made on May 9, 2024, suggests a significant breach targeting the Colombian entity. The threat actors involved in this incident have reportedly been active since February 23, 2024, according to the claims made by the group.

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. This method involves not only encrypting an organization's internal systems to disrupt operations but also stealing sensitive information. The goal is to pressure the victim into paying a ransom by threatening to publish the stolen data on public leak sites. Such sites serve as a platform for the attackers to showcase their success and exert maximum pressure on the target organization.

Details of the alleged leak and evidence provided

The announcement on the LockBit leak site includes several screenshots intended to provide evidence of the breach. These images appear to display samples of various documents that are associated with the company. To increase the pressure on the victim, the threat actors have implemented a countdown timer, indicating a specific timeframe for the public release of these files if their demands are not met.

The screenshots provided by the group contain various types of sensitive information that appear to belong to Nalsani SAS. Based on the available evidence, the following data types are reportedly included in the leak:

• Identity information
• Official documents
• Certificates

While the group has provided these visual samples, no specific information was provided regarding the total size of the data stolen or the exact number of files involved in the breach. Furthermore, no specific ransom demand has been disclosed in the current listing.

About Nalsani SAS

Nalsani SAS is a prominent e-commerce company based in Colombia. The organization operates under the Totto brand, focusing on the retail sales of a variety of consumer goods, including clothing, bags, and various accessories. Given its presence in the retail and e-commerce sector, the company manages a significant volume of consumer and corporate interactions.

Potential risks and implications of the breach

The alleged data leak poses several secondary risks that could impact the organization's stakeholders. The exposure of identity information, official documents, and certificates can lead to identity theft and the execution of highly targeted phishing attacks against the company's employees or its customer base. Such attacks often leverage the stolen context to appear legitimate, making them more difficult for individuals to detect.

Because the organization is based in Colombia, the management of this breach may require strict adherence to local data protection regulations to ensure compliance and mitigate legal liabilities. For organizations operating in the e-commerce and professional services sectors, maintaining operational continuity and protecting corporate reputation are critical challenges during such incidents.

The LockBit group has demonstrated a high level of resilience. Despite international law enforcement efforts aimed at disrupting their infrastructure, the group has shown a persistent ability to resume operations. This persistence highlights the ongoing challenge that ransomware-as-a-service models pose to global cybersecurity. To defend against such threats, organizations typically focus on robust backup strategies, continuous monitoring of network traffic, and comprehensive employee training to recognize social engineering attempts.

The incident involving Nalsani SAS may have lasting implications for the organization's reputation and its ability to maintain seamless operations. As data breaches become more frequent, the ability to respond effectively to such incidents—both technically and from a regulatory standpoint—is essential for maintaining consumer trust in the digital marketplace.