Lockbit3 claims data breach at studiogalbusera.com

• Ransomware group: Lockbit3
• Country: Italy
• Sector: Professional Services
• Announcement date: February 14, 2024

Lockbit3 claims to have compromised studiogalbusera.com

The LockBit ransomware group has listed the Italian professional services firm studiogalbusera.com on its dedicated leak site. According to the announcement made on February 14, 2024, the threat actor group claims to have successfully compromised the organization and exfiltrated a significant volume of sensitive information from its internal systems.

The group alleges that the breach occurred on the same day the announcement was posted, February 14, 2024. This rapid timeline between the claimed attack and the public listing is a common characteristic of modern ransomware operations, intended to maximize the pressure placed on the target organization.

Details of the alleged data theft

The LockBit group claims to have obtained over 500 GB of data from the firm's file servers and other critical systems. To support their claims of a successful breach, the group has provided screenshots as evidence. These screenshots reportedly contain samples of sensitive documentation, including Italian identity cards and various financial spreadsheets.

The specific types of data identified in the announcement include:

• Identity information
• Financial records

While the group has provided visual evidence of certain documents, no specific information was provided regarding the exact file count or the specific amount of a ransom demand. The announcement focuses on the volume of the exfiltrated data and the nature of the files visible in the provided samples.

About studiogalbusera.com

Studio Galbusera is an accounting and tax consultancy firm based in Milan, Italy. The organization provides a range of professional services, including tax advisory, accounting, and corporate management services to its clients.

Analysis and implications of the incident

The nature of the allegedly compromised data, which includes identity documents and financial records, may increase the risk of identity theft and fraud for the firm's clients and employees. Because the organization is based in Italy, this incident may result in legal implications under the European Union's General Data Protection Regulation (GDPR).

The tactics used by the LockBit group in this instance appear to align with double extortion. In a double extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with its public release. This method is designed to exert maximum pressure on an organization to pay the ransom, as the threat of a data leak can be more damaging than the loss of system availability alone.

Furthermore, because the victim operates within the professional services sector, the leaked data could potentially be leveraged for supply chain attacks. In such scenarios, attackers use the stolen information of a trusted service provider to gain access to or impersonate that provider when interacting with their clients. This can lead to a cascading effect where one successful breach compromises multiple downstream organizations.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite facing significant disruptions in February 2024, the group appears to be attempting to maintain its operations. For organizations in the professional services sector, maintaining robust defensive measures is critical. This includes implementing strict access controls, ensuring regular offline backups, and maintaining comprehensive monitoring of file servers to detect unauthorized data exfiltration attempts.