Lockbit3 ransomware group lists fiduagraria.gov.co on its leak site

• Ransomware group: Lockbit3
• Country: Colombia
• Sector: Financial Services
• Announcement date: May 26, 2023

LockBit3 claims to have compromised fiduagraria.gov.co

The LockBit3 ransomware group has listed fiduagraria.gov.co on its leak site, claiming to possess the organization's data. This announcement, made on May 26, 2023, marks a significant development in the ongoing targeting of financial institutions by sophisticated ransomware actors.

According to the group's claims, the attack occurred on the same day the announcement was posted, May 26, 2023. Upon listing the organization, the group initiated a countdown, a common tactic used in double extortion schemes. In such scenarios, threat actors not only encrypt an organization's systems but also steal sensitive information, threatening to publish it on a public leak site unless a ransom is paid. This pressure tactic is designed to maximize the impact of the breach by leveraging the threat of reputational damage and regulatory scrutiny.

Details of the alleged data exposure

The screenshots provided by the threat actors offer a glimpse into the nature of the alleged breach. These images display various file lists and document samples that appear to be related to the institution's operational processes. The contents of these screenshots suggest that the group has access to internal documentation used for corporate functions. Specifically, the data claimed to be involved includes:

• Financial documents
• Administrative records

While the group has provided these visual samples, they have not provided specific information regarding the total size of the data stolen or the exact number of files compromised. Furthermore, no specific ransom demand has been publicly disclosed by the group in relation to this specific listing.

About Fiduagraria

Fiduagraria is a financial services institution operating in Colombia with over 30 years of experience. It specializes in designing and managing fiduciary products and financial schemes tailored to the needs of individuals and legal entities in both the public and private sectors.

Potential implications and risks

The alleged leak of data from a long-standing financial institution poses significant risks. The potential publication of the claimed data could result in direct financial risks for the institution's clients and its business partners. Furthermore, if the data is indeed published, it could trigger legal processes under the institution's own privacy policies as well as Colombian data protection regulations.

Given the historical activities and methods of the LockBit group, there is a high probability that any leaked data could be utilized for malicious purposes, such as identity theft or highly targeted phishing attacks. Because the institution operates within the financial services sector, the secondary attack risks are heightened. Such breaches can negatively impact supply chain security, as the compromised information might provide a foothold for attackers to target the institution's partners or service providers.

In the broader context of cybersecurity, organizations in the financial sector often face these types of threats. To mitigate such risks, companies typically focus on robust defensive measures, including multi-factor authentication, regular security awareness training for employees to prevent phishing, and comprehensive data encryption to protect sensitive information at rest and in transit. Maintaining a strong incident response plan is also a critical component of modern cybersecurity defense strategies.