Lockbit3 ransomware group lists randi-group.com on its leak site

• Ransomware group: Lockbit3
• Country: Italy
• Sector: Manufacturing
• Announcement date: May 9, 2024

LockBit3 claims data breach against Randi Group

The LockBit3 ransomware group has officially listed the Italian organization randi-group.com on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully breached the organization's systems and obtained sensitive data. This listing follows a pattern of double extortion, a tactic where ransomware groups not only encrypt an organization's data but also threaten to leak it publicly to increase pressure for ransom payments.

The announcement was posted on May 9, 2024. While the group claims to have gained access to the organization's internal systems, they have not provided specific details regarding the total volume of data stolen or the exact amount of the ransom demand. The group's post included a countdown timer, a common psychological tactic used by ransomware operators to create a sense of urgency and pressure the victim into compliance before the stolen information is released to the public.

Details of the claimed data theft

The LockBit3 group has provided evidence to support their claims by sharing various screenshots of documents allegedly stolen from the organization. These visual proofs are intended to demonstrate the depth of their access to the victim's internal environment. Based on the screenshots provided by the attackers, the leaked information appears to consist of several types of sensitive documentation. The specific categories of data identified in the leak include:

• Financial documents
• Commercial correspondence
• Invoice records

The presence of such documentation suggests that the attackers may have gained access to the administrative and operational layers of the company's digital infrastructure. Such leaks can have significant implications for the integrity of business operations and the privacy of associated parties.

About Randi Group

Randi Group is an Italian company that operates within the agri-food sector. The organization specializes in the production and processing of grape seed oil and various natural products derived from grapes. Their business model focuses on the utilization of grape by-products to create specialized solutions intended for both industrial and food applications. Given their role in the manufacturing and processing of food-related products, the organization maintains a complex supply chain involving various industrial and commercial partners.

Analysis and potential impact

The data shared by the LockBit3 group poses significant risks to the commercial operations of Randi Group and its business partners. Because the organization is based in Italy, this potential breach may trigger legal obligations under the General Data Protection Regulation (GDPR), which governs how personal and sensitive data must be protected and reported in the event of a compromise. The content of the shared documents, which includes financial and commercial records, may contain highly sensitive information regarding the organization's supply chain and its internal financial processes.

Furthermore, leaks of this nature can serve as a foundation for secondary cyberattacks. Information such as invoice records and commercial correspondence can be exploited by malicious actors to conduct identity theft or to launch highly targeted phishing attacks against the organization or its clients. By understanding the context of these communications, attackers can craft more convincing social engineering schemes.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. It has been reported that the group resumed its operations following international law enforcement actions conducted in February 2024. Organizations in the manufacturing and agri-food sectors should remain vigilant, as these industries often manage complex networks of suppliers and customers, making them potential targets for sophisticated threat actors seeking to disrupt supply chains or exploit commercial relationships.