Lockbit3 ransomware group lists tormetal.cl on its leak site

• Ransomware group: Lockbit3
• Country: Chile
• Sector: Manufacturing
• Announcement date: February 16, 2024

LockBit3 claims data breach against Tormetal

The LockBit ransomware group has listed the Chilean organization tormetal.cl on its dedicated leak site, alleging that a data breach has occurred. This announcement, made on February 16, 2024, marks the latest instance of the group targeting industrial entities. The group claims to have successfully compromised the digital assets of the organization and has initiated a countdown timer regarding the publication of the files.

In such scenarios, ransomware groups often employ a tactic known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to release stolen information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of their proprietary or private information.

Details of the claimed attack

According to the announcement published by the LockBit group, the group has gained access to the digital assets belonging to tormetal.cl. The group has indicated their intention to leak the data they have acquired. As of the current information, the group has set a countdown timer, which is a common pressure tactic used to create a sense of urgency for the victim and to increase the visibility of the threat to the public.

Regarding the specific nature of the information involved in this incident, no specific details regarding the nature of the leaked or threatened data have been provided by the group. The listing does not specify the types of files, the volume of data, or the specific categories of information that have been targeted during the intrusion.

About Tormetal

Tormetal is a Chile-based company that operates in the manufacturing and distribution of metalworking, fasteners, and industrial hardware products. The organization serves the industrial sector through the provision of various hardware and metalworking components.

Risk assessment and industry implications

This incident may indicate a risk of exposure for sensitive corporate or customer data held by tormetal.cl. Given the past activities of the LockBit group, the compromised data could potentially be utilized for secondary attacks or phishing campaigns. When sensitive data is leaked, threat actors often use it to conduct highly targeted social engineering attacks against employees or customers, or they may sell the information on illicit forums.

Furthermore, the institution may face legal obligations under data protection regulations in Chile. Organizations facing such threats often prioritize incident response protocols, which include isolating affected systems, conducting forensic investigations to determine the scope of the breach, and notifying relevant regulatory authorities and affected parties.

The LockBit group has been active since 2019 and has resumed operations following the disruptions in February 2024; this may suggest an attempt by the group to maintain operational continuity. For organizations in the manufacturing and industrial hardware sectors, maintaining robust cybersecurity postures is essential to protect intellectual property and supply chain integrity. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing.