marianoshoes.com targeted by LockBit ransomware group

• Ransomware group: Lockbit3
• Country: Portugal
• Sector: Manufacturing
• Announcement date: September 3, 2023

The LockBit ransomware group has officially listed marianoshoes.com on its dedicated leak site. Through this announcement, the threat actor group claims that it will publish the organization's data, marking a potential significant data breach for the Portuguese manufacturer.

The details of the claim

The LockBit group added marianoshoes.com to its leak platform on September 3, 2023. According to the group's announcement, they intend to publish all available data belonging to the organization. To support their claims of a successful intrusion, the group shared screenshots within the announcement that allegedly show various database files.

Ransomware groups often utilize these leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data publicly, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Data involved in the incident

Based on the screenshots provided by the LockBit group, the leaked information appears to include critical database files and logistical information. The specific items identified in the announcement include:

• Database backup files
• Logistics records

The screenshots specifically display database backup files with extensions such as .BAK, .MDF, and .LDF, alongside tables containing records related to logistics and shipments. While the group has claimed they will publish all available data, no specific information was provided regarding the total size of the data or the exact file count involved in this incident. Additionally, no ransom demand has been disclosed in the current listing.

About marianoshoes.com

Mariano Shoes is a long-established Portuguese footwear manufacturer. Founded in 1945 by master craftsman Manuel de Almeida Jorge, the company specializes in the production of high-quality men's shoes. The organization is known for combining traditional artisanal techniques with modern designs throughout its production processes.

Analysis and potential impact

This incident suggests that the organization's operational data and database backups may have been compromised. If the data is indeed published, the organization's trade secrets and customer information could become accessible to third parties. Furthermore, as a Portugal-based entity, the leak may lead to legal sanctions under the European Union's General Data Protection Regulation (GDPR).

The involvement of the LockBit group is particularly notable. LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. Although its infrastructure was disrupted by an international operation in February 2024, it has been reported to have resumed operations since that time. This persistence highlights the ongoing threat posed by sophisticated RaaS models.

The potential consequences of this breach extend beyond the organization itself. Secondary risks may arise for the organization's supply chain partners and customers, particularly if logistics and shipment records are exposed. Such exposure can lead to downstream vulnerabilities or targeted social engineering attacks against the company's business associates.

For organizations in the manufacturing sector, such incidents underscore the importance of robust cybersecurity frameworks. Defensive measures often include maintaining offline, immutable backups to ensure data integrity and implementing strict access controls to protect sensitive database files. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations are essential components of a modern security posture.