Lockbit3 ransomware group lists concrejato.com.br on its leak site

• Ransomware group: Lockbit3
• Country: Brazil
• Sector: Manufacturing
• Announcement date: September 6, 2023

Lockbit3 claims data exfiltration from Concrejato

The Lockbit3 ransomware group has officially listed the Brazil-based company Concrejato on its dedicated leak site. According to the announcement, the threat actors claim to have successfully exfiltrated data belonging to the organization. This development marks a significant escalation in the pressure placed upon the company by the cybercriminal group.

The incident was announced on September 6, 2023, which coincides with the date the group claims the attack took place. In their public post, the threat actors have issued a ransom demand of 699,999 USD. The group has explicitly stated that all stolen data will be published on their platform if the specified payment is not made within the designated deadline. This tactic is a hallmark of modern ransomware operations, where the threat of public exposure is used as a primary lever for extortion.

Details regarding the claimed data breach

Regarding the specific nature of the information allegedly stolen, the announcement does not provide specific details regarding the nature of the exfiltrated data. While the exact contents of the breach remain unconfirmed, the context of the company's operations suggests potential risks. Given the company's focus on industrial and structural services, it is possible that technical projects and corporate data may be at risk.

The listing names no specific data types in a detailed list, leaving the full scope of the potential breach unknown at this time.

About Concrejato

Concrejato is a Brazilian construction company with a long-standing history in the industry, having been founded in the 1970s. The organization specializes in providing technical services for various complex projects, including industrial and special works. Their expertise extends to structural reinforcement, restoration, retrofitting, and the essential maintenance of distribution infrastructure.

Analysis and broader implications

LockBit is a ransomware group that has been observed in the threat landscape since 2019. The group is known to have undergone a reorganization following international law enforcement operations conducted in February 2024. This alleged data breach could lead to the exposure of the company's trade secrets, customer information, or operational data. Such an exposure poses significant risks to the organization's competitive standing and client trust.

For companies operating in Brazil, this type of incident may trigger legal sanctions and complex compliance processes under the LGPD (General Data Protection Law). Beyond the immediate legal concerns, there are significant secondary risks. The leaked data could potentially be utilized by malicious actors for identity theft or to facilitate highly targeted phishing attacks against the company's employees or partners.

The group is employing a double-extortion method, a strategy designed to exert maximum pressure on the organization. By threatening the confidentiality of the data in addition to the encryption of systems, the attackers aim to ensure that the victim feels compelled to pay to prevent the public release of sensitive information. This method significantly increases the complexity of incident response for the targeted organization.

In general, organizations facing such threats often focus on strengthening their perimeter defenses, implementing robust backup strategies, and conducting regular security awareness training to mitigate the risk of initial access. Furthermore, maintaining a clear incident response plan and ensuring compliance with regional data protection regulations are critical components of a modern cybersecurity posture.