Paretophone.com listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Country: Australia
• Sector: Technology
• Announcement date: July 31, 2023

Lockbit3 claims data breach at paretophone.com

The LockBit ransomware group has listed the Australian organization paretophone.com on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated a significant volume of data from the target organization.

The group's claim, which was posted on July 31, 2023, alleges that they have obtained 150 GB of information. The threat actors have threatened to publish this stolen data on their platform if their demands are not met. This type of public listing is a hallmark of modern ransomware operations, where the pressure to pay is increased through the threat of public exposure.

Details of the alleged data exfiltration

The details provided by the LockBit3 group suggest that the stolen information is highly sensitive in nature. The group claims that the 150 GB of data they have acquired includes various types of confidential documentation and personal identifiers. Specifically, the listing identifies the following types of affected data:

• Personal data
• Non-disclosure agreements (NDA)

The inclusion of non-disclosure agreements indicates that the breach may involve sensitive corporate contracts and legal arrangements, which can be highly damaging if released to the public. While the group has claimed to possess a large volume of data, they have not provided information regarding a specific ransom demand.

About paretophone.com

Paretophone.com is an organization based in Australia that operates within the technology sector. The company specializes in providing IVE Tele-fundraising services, which involves conducting data-driven and sustainable tele-fundraising campaigns for various charities. Their primary business model focuses on providing telephone communication and campaign management services to help charitable organizations reach their goals through structured tele-fundraising efforts.

Analysis and potential impact

LockBit is a well-known ransomware-as-a-service (RaaS) group that has been active in the cyber threat landscape since 2019. Although the group's infrastructure faced a significant disruption due to an international law enforcement operation in February 2024, reports indicate that the group has since resumed its malicious activities. This resilience highlights the ongoing challenge that RaaS models pose to global cybersecurity.

The alleged exfiltration of personal data and legal documents poses several secondary risks. For the employees and customers of the organization, the theft of personal information can lead to identity theft or the execution of highly targeted phishing attacks. Such attacks often use the stolen context to appear legitimate, making them difficult for individuals to detect.

Furthermore, the use of a double-extortion tactic—where attackers not only encrypt systems but also threaten to leak sensitive data—creates significant operational and reputational risks. For an organization in the technology and fundraising services sector, a breach of this nature could trigger complex legal processes under relevant data protection regulations. Organizations in this sector typically focus on robust data protection, encryption of sensitive files, and strict access controls to mitigate the risk of such significant data exfiltration events.