Lockbit3 ransomware group lists ondozabal.com on its leak site

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Manufacturing
• Announcement date: May 9, 2024

The LockBit ransomware group has listed the Spanish manufacturing company ondozabal.com on its leak site. This listing constitutes a claim by the threat actor group that they have successfully targeted the organization and intend to publish its data.

The claimed attack and event details

According to the announcement made on the LockBit leak site, the group claims to have targeted the organization as far back as March 1, 2024. The announcement itself was officially posted on the leak site on May 9, 2024. Through this listing, the group asserts that they have obtained data specifically related to the organization's core business operations, including its CNC machining and boilermaking activities.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat of releasing this stolen information on a public platform is used to pressure the victim into paying a ransom. By listing a target on a leak site, the group signals to the public and the victim that the breach is real and that the pressure to comply with their demands is increasing.

Data and information involved in the claim

The LockBit group has provided sample documents to support their claim of a successful data breach. These samples suggest that the stolen information is not limited to a single category but spans various critical business functions. Based on the documents shown in the screenshots provided by the group, the following types of information are reportedly involved:

• Bank receipts
• Commercial contracts
• Manufacturing records

The presence of such documents indicates that the breach may involve sensitive financial and operational details. When attackers gain access to commercial contracts and bank receipts, they acquire insight into the victim's business relationships, payment structures, and financial standing. Similarly, manufacturing records contain proprietary information regarding the company's internal processes and production history.

About ondozabal.com

Ondozabal is a manufacturing company based in Spain. Having been in operation since 1932, the organization provides specialized industrial services. Their core business offerings include CNC machining, embossing, and integrated boilermaking services.

Assessment and implications

The claim made by the LockBit group indicates that the organization's financial and operational data may be at risk of exposure. Because the organization is based in Spain, this incident may trigger specific legal processes and data breach notification requirements under the General Data Protection Regulation (GDPR). The nature of the shared sample documents suggests that sensitive information regarding the organization's commercial partnerships and financial transactions could be exposed to the public.

Given the established history and tactics of the LockBit group, this situation may lead to significant reputational damage and could potentially expose the organization to secondary attack risks. When sensitive business data is leaked, it can be used by other malicious actors for targeted phishing, social engineering, or further fraudulent activities against the company or its partners.

Organizations operating in the manufacturing sector often face unique risks due to the highly specialized nature of their operations and the importance of their supply chain relationships. To mitigate such risks, companies typically focus on robust defensive measures. This includes implementing strict access controls to protect sensitive manufacturing and financial records, maintaining comprehensive logging to detect unauthorized access early, and ensuring that all digital assets are backed up and isolated from the main network. Furthermore, maintaining a clear incident response plan and ensuring compliance with regional data protection regulations are essential steps for managing the fallout of a potential data exposure.