Lockbit3 claims data breach at ciasc.mx

• Ransomware group: Lockbit3
• Country: Mexico
• Sector: Professional Services
• Announcement date: December 22, 2023

Lockbit3 claims to have stolen data from ciasc.mx

The Lockbit3 ransomware group has listed the Mexican-based professional services firm ciasc.mx on its dedicated leak site. Through this announcement, the threat actor group claims to be in possession of sensitive data belonging to the organization. This listing serves as a public notification from the group, alleging that they have successfully breached the firm's systems and acquired internal documentation.

The event involves the alleged theft of documents specifically related to the firm's core business operations. According to the claims made by the ransomware group, the stolen information pertains to the organization's credit investigation and portfolio recovery activities. To increase the pressure on the target organization, the group has reportedly established a deadline for the publication of these files, a common tactic used by ransomware operators to coerce victims into meeting ransom demands.

Details of the alleged data exposure

The group has provided screenshots intended to demonstrate the validity of their claims. These images purportedly show a wide range of sensitive information that could pose significant risks to the organization and its clients. The data types identified in the screenshots include:

• Credit card information
• Customer contact details
• Financial data
• Legal documents

The presence of such diverse data types, ranging from financial performance tables to specific customer contact details and phone numbers, highlights the potential breadth of the breach. Additionally, the leaked material reportedly includes documents related to legal proceedings, which are highly sensitive in nature.

About ciasc.mx

Consultores y Investigadores en Administración (CIASC) is a professional services firm based in Mexico. Founded in 1993, the company specializes in credit investigation and portfolio recovery services. Their operational model involves managing both out-of-court and judicial routes to assist clients with debt and credit-related matters.

Impact assessment and industry implications

The alleged leak of this information carries significant risks for the organization and its stakeholders. For the firm's clients, the exposure of credit card information and contact details significantly increases the risk of identity theft and fraudulent activities. Furthermore, the exposure of financial data and legal documents could severely damage the operational credibility of the organization. Such a breach may also trigger legal proceedings under Mexican data protection regulations due to the sensitive nature of the information handled by the firm.

Lockbit3 is known for employing double-extortion tactics. In these scenarios, attackers do not just encrypt an organization's data but also steal it, threatening to leak it publicly if the ransom is not paid. This tactic ensures that even if an organization can restore its systems from backups, the threat of data exposure remains a powerful lever for the attackers. Consequently, the publication of this data may expose the firm's supply chain partners to targeted phishing attacks, as attackers often use stolen contact information to launch secondary campaigns.

The continued activity of the Lockbit3 group, despite ongoing international law enforcement operations targeting their infrastructure, suggests a persistent threat landscape. Organizations operating in the professional services sector, particularly those handling sensitive financial and legal data, must remain vigilant. Common defensive measures to mitigate such risks include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all systems, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. Furthermore, maintaining a comprehensive incident response plan and conducting regular security audits can help organizations respond more effectively to the evolving tactics used by ransomware groups.