Lockbit3 lists policiaauxiliarcusaem.com.mx on leak site

• Ransomware group: Lockbit3
• Country: Mexico
• Sector: Government & Defense
• Announcement date: August 22, 2024

Lockbit3 claims attack on Mexican security organization

The Lockbit3 ransomware group has listed the Mexico-based police auxiliary unit policiaauxiliarcusaem.com.mx on its leak site. This announcement, which appeared on the group's platform on August 22, 2024, marks a new potential data breach involving a government-funded security entity.

Details of the alleged intrusion

According to the announcement published by the threat actors, the group claims to have gained unauthorized access to the organization's network on August 16, 2024. This alleged intrusion occurred several days before the formal listing of the victim on the group's leak site. The threat actors describe the target as a government-funded private police auxiliary unit operating within the jurisdiction of Mexico.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information if the ransom is not met. While the group has made this claim, the specific circumstances of the initial access remain unconfirmed.

Information regarding the compromised data

At this time, no details regarding the nature of the alleged leaked or compromised data have been provided by the attackers. The available evidence, such as the screenshot provided by the group, merely displays the general interface of the leak site and does not contain any specific data samples or indicators of what was actually taken.

The listing names no specific data types.

About CUSAEM

CUSAEM (Cuerpos de Seguridad Auxiliar del Estado de México) is a government-funded private police auxiliary organization based in the State of Mexico, Mexico. The institution provides security and protection services to various public and private sector entities.

Security implications and risks

Given that the organization is a government-funded security unit, the sensitivity of potentially compromised data may pose significant risks. A potential data breach could lead to security vulnerabilities for the organization's personnel and operational processes. Furthermore, the organization may face legal obligations under Mexican local data protection regulations following such an incident.

The LockBit group is a Ransomware-as-a-Service (RaaS) operation that has been tracked since 2019. The group has continued its activities despite significant infrastructure disruptions that occurred in February 2024. Secondary risks associated with this incident may include the potential use of leaked data in identity theft or targeted phishing campaigns against the organization or its stakeholders.

Organizations operating in the government and security sectors often implement defensive measures such as multi-factor authentication, network segmentation, and continuous monitoring to mitigate these risks. Maintaining robust incident response plans and ensuring compliance with local data protection laws are also critical components of a modern cybersecurity posture.