Lockbit3 lists selmi.com.br on leak site

• Ransomware group: Lockbit3
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: July 16, 2023

The Lockbit3 ransomware group has listed the Brazil-based food manufacturer selmi.com.br on its leak site, claiming that it will publish the company's data. This development follows a pattern of double extortion, where threat actors not only encrypt an organization's systems but also threaten to release sensitive information to pressure the victim into paying a ransom.

The claimed attack and event details

According to the claims made by the Lockbit group, the data belonging to selmi.com.br was compromised on July 11, 2023. The group announced that sensitive information regarding the company's production and distribution processes would be released to the public. This type of threat is a hallmark of modern ransomware operations, where the goal is to maximize leverage over a target by threatening their commercial reputation and operational stability.

As part of their announcement, the group has already begun sharing samples of documents. These shared files appear to contain operational details of the company, serving as a proof of theft to validate their claims to the victim and the public. The announcement of this breach was officially posted on the group's leak site on July 16, 2023.

Data involved in the breach

The information shared by the attackers includes screenshots of documents that appear to be related to the company's internal operations. Based on the available evidence, the following types of data are allegedly involved in the breach:

• Financial documents
• Official correspondence

While the specific volume of the data and the exact number of files taken have not been disclosed by the group, the presence of financial and official records suggests a significant breach of corporate information.

About selmi.com.br

Founded in 1966, Selmi is a Brazilian food company that manufactures dry pasta, traditional pasta, cookies, crackers, cakes, and baking mixes. The company operates with two production sites and thirteen distribution centers across the country, making it a significant player in the regional food production and distribution landscape.

Analysis and potential implications

The actions taken by the Lockbit group may negatively impact the company's operational continuity and commercial reputation. The allegedly leaked data could pose secondary risks, such as identity theft or targeted phishing attacks, for the company's employees and business partners. Furthermore, the scope and content of the breach may present risks in terms of supply chain security, as the compromise of a major food producer can have ripple effects throughout the distribution network.

Under Brazil's LGPD regulations, the company may be required to fulfill data breach notification obligations. It is important to note that Lockbit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite its infrastructure being disrupted in February 2024, it has been observed to continue its operations.

For organizations in the agriculture and food production sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include maintaining offline backups, implementing multi-factor authentication, and conducting regular security audits to protect sensitive production and financial data. Protecting the integrity of the supply chain is essential to prevent secondary attacks that target partners and distributors through stolen correspondence or credentials.