Lockbit3 ransomware group lists cezam.net on its leak site

• Ransomware group: Lockbit3
• Country: Belgium
• Sector: Manufacturing
• Announcement date: April 11, 2023

Lockbit3 claims data breach against cezam.net

The Lockbit3 ransomware group has listed the Belgium-based manufacturing firm cezam.net on its dedicated leak site. Through this listing, the threat actor group claims that the company's data will be published, signaling a potential data breach involving the organization.

On April 11, 2023, the Lockbit group added cezam.net to its leak site. In this instance, the threat actor has initiated a countdown process, threatening to publish the company's data if demands are not met. Lockbit3 is known to operate as a Ransomware-as-a-Service (RaaS) model. This specific group has been active since 2019 and has previously experienced infrastructure disruptions resulting from international operations in February 2024.

Ransomware leak sites are a central component of modern double extortion tactics. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information. The threat of releasing this stolen data on a public platform is used as leverage to pressure the victim into paying a ransom. This method increases the pressure on an organization, as the consequences extend beyond operational downtime to include significant reputational and legal risks.

Details of the claimed data exposure

While the group has made claims regarding the breach, there is no clear information regarding the full scope of the leaked data. The available information is limited to what has been presented in samples provided by the attackers.

Based on the screenshots provided by the group, the samples include various documents that suggest the following types of information may be involved:

• Commercial correspondence
• Order records
• Corporate file directories

It is important to note that the exact volume and the complete contents of the data remain unconfirmed. In many ransomware incidents, the amount of data stolen and the specific files targeted can vary significantly, making it difficult for organizations to assess the full impact immediately after a listing appears on a leak site.

About cezam.net

Cezam SA is a Belgium-based manufacturer of carpentry and construction products. The company produces and sells aluminum and PVC door and window systems.

Impact and organizational risks

This incident may pose risks to the company's operational continuity and commercial reputation. Because the firm operates in Belgium, a potential data leak could trigger legal sanctions and notification obligations under the GDPR (EU General Data Protection Regulation). The publication of such data might negatively impact the company's supply chain and customer relations.

Given the past methods of the Lockbit group, it is possible that the leaked data could be utilized for secondary attacks or identity theft. The exposure of the company's data may lead to employees and business partners being targeted by phishing attacks. Such follow-on attacks often use the stolen context—such as commercial correspondence or order details—to craft highly convincing social engineering messages.

For organizations operating in the manufacturing sector, maintaining robust cybersecurity posture is critical to protecting supply chain integrity. Defensive strategies often include implementing strict access controls, maintaining offline backups, and conducting regular employee training to recognize phishing attempts. Furthermore, ensuring compliance with regional data protection regulations is essential to mitigate the legal and financial consequences that follow a data exposure event.