Lockbit3 ransomware group lists marktel.es on its leak site

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Technology
• Announcement date: October 12, 2022

Lockbit3 claims access to marktel.es systems

The Lockbit3 ransomware group has announced the listing of marktel.es on its dedicated leak site. This announcement, which appeared on October 12, 2022, indicates that the threat actor group claims to have successfully gained access to the institution's internal systems.

According to the announcement published by the group, the incident is categorized as a data breach. While the group asserts they have breached the perimeter of the organization, the claim remains an assertion made by the threat actor. At this stage, the group has not provided detailed information or any forensic evidence regarding the specific content of the alleged leak.

Details regarding the leaked data

Despite the announcement of a breach, there is currently no information available regarding the nature of the leaked data. The threat actor has not provided any screenshots or specific documentation to substantiate the claims made on their leak site. Consequently, the specific types of files or the volume of information involved remain unknown.

• No specific data types were named in the listing.

About marktel.es

Marktel is a Spain-based outsourcing and customer experience management company. The organization provides digital solutions for various business processes, including customer service, sales, and technical support processes.

Analysis and potential risks

This incident may indicate potential vulnerabilities in the institution's data security processes. Depending on the nature of the leaked data, several risks may emerge for the institution's employees and customers, such as identity theft or targeted phishing attacks. Furthermore, there are secondary risks to consider, including the potential for the leaked data to be utilized by other threat actors in future campaigns.

Regarding the threat actor, information about the Lockbit3 group is limited. However, their past activities suggest they may employ double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with public disclosure unless a ransom is paid.

From a regulatory perspective, in accordance with GDPR regulations applicable across the European Union, the institution may be required to fulfill data breach notification obligations. Organizations operating in the technology and outsourcing sectors often face significant pressure to maintain robust security postures to protect client data. Common defensive steps for organizations facing such threats include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent vulnerability assessments to mitigate the risk of unauthorized access.