Lockbit3 claims data leak involving cafesnovell.com

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: May 25, 2024

The Lockbit3 ransomware group has officially claimed a data leak involving the organization cafesnovell.com. According to an announcement made on the group's leak site, the threat actor group alleges to have successfully exfiltrated sensitive information from the company's systems.

Details of the alleged attack

The Lockbit3 ransomware group listed cafesnovell.com on its dedicated leak site, claiming to have exfiltrated data from the organization. This announcement, which was updated on May 25, 2024, to publicize the alleged data breach, includes specific details regarding the company's various business units. To support their claims of a successful intrusion and data theft, the group has shared screenshots that purportedly show the stolen files.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, the attackers do not merely encrypt a victim's files to demand a ransom for decryption; they also threaten to release sensitive, stolen data publicly if the ransom is not paid. This tactic is designed to maximize pressure on the victim by threatening their reputation, legal standing, and operational integrity. The use of screenshots is a common method for these groups to provide a sense of legitimacy to their claims, demonstrating to the victim and the public that they have indeed gained access to internal directories and sensitive documents.

Data allegedly involved in the breach

The screenshots provided by the group appear to display various types of sensitive corporate information. These include what appear to be corporate file directories, meeting minutes, financial statements, and commercial contracts. The specific items identified as being affected by this alleged exposure include:

• Financial documents
• Commercial contracts
• Meeting minutes

While the group has provided these visual proofs, no specific information was provided regarding the total size of the data stolen or the exact number of files involved. Additionally, no ransom demand has been specified in the available information.

Organization profile

The target of this alleged attack is cafesnovell.com, an organization based in Spain. The company operates within the agriculture and food production sector.

Impact and assessment

LockBit is a known ransomware-as-a-service (RaaS) group that has been active since 2019. Despite an international law enforcement operation targeting its infrastructure in February 2024, the group has reportedly resumed its operations. The persistence of such groups poses a continuous threat to various industries globally.

Because the affected organization is based in Spain, this incident may trigger regulatory obligations under the EU General Data Protection Regulation (GDPR). The alleged exposure of financial and commercial data could weaken the company's competitive position and pose risks to its relationships with third parties. Furthermore, the publication of such data may facilitate targeted phishing attacks against employees and business partners, as attackers can use the stolen information to craft highly convincing social engineering campaigns.

For organizations operating in the agriculture and food production sector, such incidents highlight the importance of robust cybersecurity frameworks. Protecting sensitive commercial contracts and financial statements is vital for maintaining competitive advantages and trust with business partners. Implementing strong access controls, regular security audits, and comprehensive employee training can help mitigate the risks associated with data exfiltration and subsequent social engineering attempts.