Lockbit3 ransomware group lists candelasyasociados.es on its leak site

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Professional Services
• Announcement date: January 13, 2025

Lockbit3 claims breach of Candelas y Asociados

The Lockbit3 ransomware group has listed the Spain-based professional services firm candelasyasociados.es on its leak site. This announcement, which appeared on January 13, 2025, indicates a potential data breach targeting the organization. While the listing has been made public on the group's platform, the threat actors have not yet provided specific details regarding the volume of data or the specific nature of the files involved.

Ransomware groups often utilize leak sites to apply pressure on victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information and threaten to publish it online if a ransom is not paid. This method aims to maximize leverage by threatening the victim's reputation and legal standing. Such sites serve as a public gallery for the group's victims, often displaying the names of targeted organizations to increase the visibility of the attack.

Details of the alleged attack

According to the claims made by the Lockbit3 group, the threat actors gained unauthorized access to the organization's network on November 30, 2024. This means the attackers claim to have had presence within the network for over a month before the public announcement was made on the leak site. The group has threatened to publish the organization's data as a consequence of their actions.

Despite the threat of publication, the group has not shared any data samples to date. Furthermore, there is no information available regarding the specific nature of the leaked data. Observations of the leak site itself indicate that it was experiencing technical difficulties at the time, specifically returning a 502 Bad Gateway error, which prevented further investigation of the listing's contents.

Organization profile

Candelas y Asociados S.L. is a Spanish consulting firm. The organization provides a variety of professional services, offering advice to both small and medium-sized enterprises (SMEs) and individuals. Their expertise covers several critical business areas, including labor law, tax, accounting, commerce, and general business consulting.

Risks and sector implications

The listing names no specific data types involved in the alleged breach. However, given that the organization operates in the professional services sector, the allegedly leaked data may contain sensitive commercial, financial, or personal information belonging to clients. This type of data is highly valued by cybercriminals for various illicit purposes.

The potential consequences for an organization in this position are significant. The exposure of sensitive client information could lead to legal sanctions and administrative fines under the European Union's General Data Protection Regulation (GDPR). Beyond the immediate legal and regulatory risks, secondary risks may arise for the organization's clients and employees, such as identity theft or targeted phishing attacks. When attackers obtain personal or financial details, they can craft highly convincing social engineering campaigns to further exploit the victims.

The Lockbit3 group is a ransomware operation that has been tracked since 2019. It is notable that the group resumed activities following an international operation in February 2024. Because of their history and ability to adapt, the group's methods and motivations should be closely monitored by security professionals. To defend against such threats, organizations in the professional services sector typically focus on robust security measures, including regular network monitoring, strict access controls, and comprehensive data encryption to mitigate the impact of a potential breach.