Lockbit3 ransomware group lists comacchio.com on its leak site

• Ransomware group: Lockbit3
• Country: Italy
• Sector: Manufacturing
• Announcement date: April 11, 2023

Lockbit3 claims data breach at comacchio.com

The Lockbit3 ransomware group has listed the Italian manufacturing company comacchio.com on its dedicated leak site. According to the announcement made by the threat actor, the group claims to have compromised the company's data and intends to publish the stolen information. This development follows a pattern of double extortion, a common ransomware tactic where attackers not only encrypt a victim's systems but also steal sensitive information to use as leverage for ransom demands.

The group's announcement, dated April 11, 2023, alleges that the compromise occurred on that same date. While the group has claimed responsibility for the attack, the specific details regarding the total volume of data stolen or the specific ransom amount demanded have not been disclosed in the public announcement. Ransomware leak sites serve as a platform for these groups to exert pressure on organizations by threatening to release sensitive corporate and personal information to the public if their demands are not met.

Details of the alleged data leak

The threat actor has provided various samples to support their claim of a successful breach. These samples, shared as screenshots within the leak site announcement, provide a glimpse into the types of information that may have been compromised. The group's claims suggest that the breach involves sensitive documentation related to the company's internal operations and business dealings.

Based on the samples provided by the group, the following types of information are reportedly affected:

• Identity information
• Invoices and commercial documents

The presence of identity documents, invoices, and commercial correspondence in the shared samples indicates that the breach may have exposed sensitive details regarding both the company's business transactions and the personal identities of individuals associated with the firm.

About Comacchio

Comacchio is an Italian-based company that operates within the manufacturing sector. The organization specializes in the design, assembly, and after-sales service of specialized heavy machinery. Specifically, Comacchio designs and manufactures drilling rigs intended for a wide variety of applications, including foundation engineering, geothermal energy, tunneling, and mining operations.

Risks and potential implications

The alleged leak of information poses significant risks to the organization and its stakeholders. For a company based in Italy, such a breach may trigger legal processes and mandatory data breach notification obligations under the General Data Protection Regulation (GDPR). The exposure of personal data belonging to employees and customers can lead to severe privacy violations and loss of trust.

Furthermore, the specific types of data leaked, such as identity documents and commercial correspondence, can be exploited by malicious actors for secondary purposes. These include identity theft and highly targeted phishing attacks, where attackers use stolen business details to craft convincing fraudulent communications. There is also a risk of secondary impacts on the company's supply chain partners, who may face their own security challenges as a result of this incident.

In the broader context of cybersecurity, manufacturing organizations often face risks from ransomware due to their reliance on complex digital systems for design and production. To defend against such threats, organizations typically implement defensive measures such as robust backup strategies, network segmentation, and continuous monitoring of their digital environments. The resilience of the supply chain is also a critical factor, as a breach in one manufacturer can create ripple effects across multiple business partners.

Lockbit is a known ransomware group that has been tracked since 2019. Despite international law enforcement operations, the group has demonstrated persistence, with reports indicating they resumed operations following an international operation in February 2024.