Lockbit3 ransomware group lists sislocar.com on its leak site

• Ransomware group: Lockbit3
• Country: Costa Rica
• Sector: Transportation
• Announcement date: May 9, 2024

LockBit claims data breach at sislocar.com

The LockBit ransomware group has listed the Costa Rican logistics firm sislocar.com on its dedicated leak site. According to the announcement made on May 9, 2024, the threat actor group claims to have gained unauthorized access to the company's systems, resulting in a data breach.

The group alleges that the intrusion occurred on April 11, 2024. While the group has posted the organization on its leak site, they have not provided information regarding a specific ransom demand. This type of activity is characteristic of modern ransomware operations, where groups often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to leak sensitive information on public platforms to pressure the victim into paying a ransom.

Details of the claimed theft

The LockBit group claims to have obtained a total of 763 files during the reported attack. To support their claims, the group provided several screenshots in their announcement. These visual samples appear to show various documents related to the company's core business functions, specifically focusing on its logistics and customs operations.

Based on the provided screenshots, the leaked content includes:

• Customs documents
• Logistics operation records
• Certification files

The presence of scanned documents, customs correspondence, and various certification files in the screenshots suggests that the stolen data is deeply integrated into the company's administrative and operational workflows.

About sislocar.com

Sislocar is a comprehensive logistics service provider headquartered in Costa Rica. The company maintains a broad service portfolio designed to support international and local trade. Their offerings include bonded warehouses and Free Zone storage solutions, as well as international and local transportation services. Additionally, the company provides customs brokerage services to facilitate the movement of goods through regulatory frameworks.

Potential impact and industry implications

The data shared by the LockBit group may contain sensitive commercial information regarding the company's logistics operations. Such a leak could potentially create secondary risks for the company's supply chain partners and clients, as the exposure of operational records can reveal details about shipping routes, client lists, or vendor arrangements. Furthermore, the leaked documents could potentially be utilized in targeted phishing attacks, where attackers use specific, legitimate-looking details to gain trust during social engineering attempts.

The organization may also face legal obligations under Costa Rica's data protection regulations following such a breach. For companies operating in the logistics and transportation sector, maintaining robust cybersecurity postures is essential to protect the integrity of the supply chain. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of phishing.

LockBit is a ransomware group that has been tracked since 2019. The group has demonstrated a persistent tendency to continue its operations despite various international efforts aimed at disrupting its infrastructure.