Lockbit3 ransomware group lists bigcenters.rs on its leak site

• Ransomware group: Lockbit3
• Country: Serbia
• Sector: Retail & E-Commerce
• Announcement date: October 12, 2022

LockBit3 claims data breach at bigcenters.rs

The LockBit group has listed bigcenters.rs on their leak site, alleging a significant data breach. This announcement, made by the threat actors, suggests that the organization has been targeted in a cyberattack aimed at exfiltrating sensitive information.

According to the claims made by the group, the incident was announced on October 12, 2022. The threat actors assert that they successfully gained unauthorized access to the organization's networks. By listing the company on their dedicated leak platform, the group is utilizing a common tactic used by ransomware operators to pressure victims through public exposure.

Details of the alleged intrusion

Regarding the specifics of the incident, the LockBit group claims to have successfully exfiltrated data from the organization's systems. However, the group has been vague regarding the specific contents of the breach. At this time, there is no information available regarding the nature of the leaked or threatened data, and no screenshot has been provided to substantiate the claims of the intrusion.

The listing serves as a public notification of the alleged breach, but it lacks granular details regarding the volume or the specific types of files that were targeted. In many ransomware scenarios, groups use these listings to demonstrate their capability and to increase the pressure on the victim organization to meet their demands.

Affected data types

The current listing names no specific data types that have been compromised.

About bigcenters.rs

Big Centers is a retail and shopping center management company operating in Serbia. The company focuses on the operation and management of various commercial spaces, serving as a key player in the regional retail and shopping center management sector.

Risk assessment and industry implications

The claim made by the LockBit group may pose significant risks to the operational continuity of the organization. If a data breach has indeed occurred, secondary risks could emerge, such as identity theft or targeted phishing attacks directed at customers and employees. These types of follow-on attacks are common when personal or corporate data is leaked onto the dark web.

Under Serbian regulations and the General Data Protection Regulation (GDPR), the organization may be required to fulfill specific data breach notification obligations to authorities and affected individuals. Maintaining compliance with these frameworks is a critical component of post-breach management.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. Despite international operations in February 2024, it has been reported to have resumed its activities, which suggests that long-term threats to organizations like bigcenters.rs may persist. The persistence of such groups highlights the ongoing necessity for robust cybersecurity postures.

For organizations operating in the retail and e-commerce sectors, maintaining operational continuity is vital. Defensive strategies typically involve implementing multi-factor authentication, conducting regular network monitoring, and ensuring that data encryption protocols are strictly followed. Because ransomware groups often use double extortion—where they both encrypt data and threaten to leak it—organizations must prioritize both robust backup solutions and comprehensive data loss prevention measures to mitigate the impact of such persistent threats.