Lockbit3 claims to have compromised calvia.com

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Technology
• Announcement date: May 9, 2024

Lockbit3 claims to have compromised calvia.com

The LockBit ransomware group has listed calvia.com on its leak site, claiming to have compromised the organization's data. This announcement, made on May 9, 2024, marks a new potential victim for the threat actor group, which has been active since 2019.

The details of the claim

On May 9, 2024, the LockBit group added calvia.com to its leak platform. Following the listing, the group has initiated a countdown, a common tactic used by ransomware operators to pressure victims into meeting their demands. This countdown indicates the group's intention to publish the organization's data if certain conditions are not met.

The announcement includes information identifying the entity as a local government administration located in Mallorca. This identification highlights the potential impact of such attacks on public administration services and the sensitive nature of the infrastructure involved in local governance.

Data involved in the incident

No specific details regarding the content of the leaked data have been provided. The screenshot provided by the threat actor contains only the organization's general descriptive text, and the listing names no specific data types.

The organization

The target of this alleged attack is calvia.com, which is identified as a local government administration in Mallorca, Spain.

Analysis and implications

This claim suggests that a security breach may have occurred within the local government's digital infrastructure. As the organization is based in Spain, a potential data leak could trigger obligations under the GDPR (EU) regarding the protection of personal data. The exposure of citizen data may lead to secondary risks such as identity theft and targeted phishing attacks.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It has been reported to have resumed operations following an international disruption in February 2024; this may indicate that the group's operational capacity remains active. The resumption of activity after such disruptions is a significant indicator of the group's resilience and ongoing threat to various sectors.

In the context of modern cyber threats, ransomware groups often employ double extortion tactics. This involves not only encrypting an organization's files to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to leak the stolen information on a public platform, the attackers increase the pressure on the victim to pay the ransom. This method is particularly effective against organizations that handle large volumes of sensitive information, such as government entities.

For organizations operating in the technology and public administration sectors, maintaining robust cybersecurity posture is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, maintaining regular and offline backups, and conducting frequent security audits. Furthermore, organizations must be prepared to respond to potential breaches by following established incident response protocols and ensuring compliance with regional data protection regulations to mitigate legal and reputational damage.