Lockbit3 ransomware group lists meroso.be on its leak site

• Ransomware group: Lockbit3
• Country: Belgium
• Sector: Agriculture and Food Production
• Announcement date: September 6, 2023

Lockbit3 claims attack on Meroso Foods

The Lockbit3 ransomware group has published a leak announcement on its dedicated leak site, claiming to have compromised data belonging to the Belgian organization meroso.be. According to the announcement made on September 6, 2023, the threat actors have initiated a countdown process intended to pressure the organization before any potential publication of the stolen information occurs.

This type of activity is characteristic of modern ransomware operations, which often employ double extortion tactics. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to release this information publicly, the threat actors aim to increase the pressure on the target to meet their demands. The use of a countdown timer is a common psychological tactic used by ransomware groups to create a sense of urgency and panic within the victim organization.

The ransom demand and claimed event

The threat actor behind the Lockbit3 group has issued a specific ransom demand of 249,000 USD from the organization. The claim suggests that the attack occurred on the same day the announcement was made, September 6, 2023. While the group has asserted that they have successfully breached the target, the specific details regarding the method of entry or the exact nature of the intrusion have not been disclosed in the initial leak site announcement.

Data involvement and content

Regarding the specifics of the breach, the group has not shared any information concerning the type or the content of the allegedly compromised data. The listing does not specify the volume of files or the total size of the data involved in the incident.

• No specific data types or content were identified in the announcement.

When ransomware groups claim a breach without providing immediate samples, it often leaves the target in a state of uncertainty regarding the scope of the exposure. This lack of transparency is a common hurdle for incident responders who must determine whether the breach involves intellectual property, employee records, or financial documentation.

About Meroso Foods

Meroso Foods is a Belgium-based food manufacturer with a deep-rooted history spanning over 60 years. The company specializes in the development and production of various food products, serving as a long-standing entity within the Belgian food production sector.

Risk assessment and industry implications

This situation may pose a significant risk to the operational continuity of the organization. If the claimed data is indeed published, there is a possibility that sensitive information, such as trade secrets and customer data, could be exposed to the public or to competitors.

Furthermore, as an organization operating in Belgium, Meroso Foods may face administrative sanctions due to data protection obligations under the General Data Protection Regulation (GDPR). Regulatory frameworks like GDPR require organizations to implement robust security measures to protect personal data, and a successful breach can lead to investigations and significant fines if negligence is found.

The Lockbit group is known as a Ransomware-as-a-Service (RaaS) based entity that has been active since 2019. Although its infrastructure was disrupted in 2024, it has been reported to have resumed operations. This resilience highlights the ongoing threat posed by sophisticated cybercriminal groups. For organizations in the food production sector, it is advisable to review network security against secondary attack risks and ensure that defensive measures are updated to counter evolving RaaS models. Maintaining strict access controls and monitoring for unauthorized data exfiltration are critical steps in mitigating the impact of such targeted campaigns.