Lts.com.vn targeted in data breach claim by Flocker

• Ransomware group: Flocker
• Country: Vietnam
• Sector: Technology
• Announcement date: June 5, 2025

Flocker claims a data breach at Lts.com.vn

The threat actor known as Flocker has announced a data leak, claiming to have breached the systems of Lts.com.vn. This announcement, made via a leak site, suggests that the organization's digital infrastructure has been compromised by the group.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. In many modern cyberattacks, a tactic known as double extortion is employed. In these scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information. The threat actors then threaten to release this stolen data publicly if the ransom demands are not met, thereby leveraging the threat of reputational damage and regulatory scrutiny to increase their leverage.

Details of the alleged attack

According to the claims made by the Flocker group, they gained access to the main systems of Lts.com.vn on May 28, 2025. The group alleges that the breach specifically compromised data belonging to LTS LAW, which is a unit of the institution specializing in legal and corporate services.

To support their claims, the group has listed files on its leak site that it purports to be evidence of the breach. While the presence of these files on a leak site is a common tactic used by ransomware groups to demonstrate the success of their intrusion, the authenticity of such claims is often a central point of investigation for cybersecurity professionals.

Scope of the leaked information

No specific details regarding the content of the leaked data have been provided by the threat actor. However, given that the institution operates in the legal and corporate services sector, it is possible that client information and corporate correspondence may be at risk.

The listing names no specific data types.

Organizational profile

LTS Group is a technology and software development company based in Vietnam. The company provides software outsourcing, AI solutions, and digital transformation services.

Potential impact and industry implications

This incident may create negative impacts on the institution's client confidentiality and data security processes. A data breach at an institution operating in the legal sector could lead to the exposure of client data, resulting in reputational damage and potential legal sanctions. Furthermore, the institution may face notification obligations under Vietnam's data protection regulations.

Beyond the immediate legal and regulatory concerns, there is a significant risk regarding the utility of the stolen information. It is possible that the leaked data could be utilized for identity theft or targeted phishing attacks against the organization or its clients. Targeted phishing, or spear-phishing, is a common secondary phase of an attack where stolen corporate correspondence is used to craft highly convincing fraudulent messages to deceive employees or clients.

For organizations operating in sensitive sectors such as legal services, maintaining robust defensive postures is critical. Common defensive steps for organizations include implementing multi-factor authentication (MFA) across all systems, maintaining offline backups of critical data, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, continuous monitoring of network traffic and implementing strict access controls can help mitigate the risk of unauthorized lateral movement within a network.

Public information regarding the Flocker group remains limited, making it difficult to attribute the attack to a specific known entity or to understand their specific motivations beyond the standard ransomware model.