Lockbit3 ransomware group lists grantierra.com on its leak site

• Ransomware group: Lockbit3
• Country: Ecuador
• Sector: Energy & Utilities
• Announcement date: May 28, 2023

The LockBit ransomware group has listed Gran Tierra Energy on its dedicated leak site, claiming that the organization has fallen victim to a significant data breach. According to the claims made by the threat actor, the group has successfully accessed internal files and has asserted that they have obtained a substantial amount of sensitive information from the company.

Details of the alleged attack

The incident, which was announced on the LockBit leak site on May 28, 2023, involves claims of a massive data exfiltration. The ransomware group asserts that they have successfully accessed the internal systems of Gran Tierra Energy and have obtained over 150 GB of data. The group has reportedly set a countdown for the publication of this data, a common tactic used in extortion schemes to pressure victims into meeting ransom demands.

Ransomware groups often employ a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. By threatening to leak this stolen data on public forums or specialized leak sites, the attackers create a secondary layer of pressure. This tactic is designed to force the victim to pay even if they have robust backups to restore their operational systems, as the threat of public exposure of sensitive data remains a potent motivator.

The alleged stolen data

The information claimed to be in the possession of the LockBit group includes a variety of sensitive corporate and personal documents. Based on the claims made by the attackers, the data includes:

• Passport data
• Company contracts
• Payment records

The group has provided screenshots as evidence of the breach, which reportedly include samples of passports. The presence of such highly sensitive personal identification documents significantly increases the severity of the incident, as these items are prime targets for identity theft and fraudulent activities.

About Gran Tierra Energy

Gran Tierra Energy is an oil and gas company that was founded in 2005. Headquartered in Calgary, Canada, the company focuses its primary operations on oil and gas exploration and production activities within Colombia and Ecuador.

Risk assessment and implications

The alleged leak of this data poses a significant risk of identity theft for the directors and employees whose personal information was reportedly compromised. Because the stolen data includes passport samples, there is a high risk that the victims could be targeted in highly specific and sophisticated phishing campaigns. Such campaigns often use stolen personal details to gain the trust of the target, making the fraudulent communication appear legitimate.

Furthermore, the disclosure of corporate documents may have a negative impact on the organization's supply chain security. When internal contracts and payment records are exposed, it can compromise the trust and security of the entire network of partners and vendors associated with the company. The incident may also trigger regulatory scrutiny under various data protection frameworks, given that the company operates in Colombia and Ecuador and is headquartered in Canada.

In the energy and utilities sector, such breaches can have wide-reaching consequences. Organizations in this sector often implement various defensive measures to protect their infrastructure and data, such as network segmentation, multi-factor authentication, and continuous monitoring. However, as seen in this case, the threat of secondary extortion through data leaks remains a critical challenge for modern enterprises. The exposure of sensitive corporate information can lead to long-term reputational damage and legal complications that extend far beyond the initial cyberattack.