Payday.com.pa targeted by Lockbit3 ransomware group

• Ransomware group: Lockbit3
• Country: Panama
• Sector: Professional Services
• Announcement date: June 6, 2023

Lockbit3 claims data breach at payday.com.pa

The LockBit ransomware group has announced its intention to publish data belonging to payday.com.pa on its dedicated leak site. This announcement, which appeared on June 6, 2023, indicates that the organization has been targeted in a cyberattack. The group has already begun a countdown process, suggesting that the publication of the institution's data is imminent if certain conditions are not met.

Ransomware groups often use leak sites to pressure victims into paying ransoms. This tactic is frequently associated with a strategy known as double extortion. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information. The threat of releasing this stolen data publicly serves as additional leverage to force the organization to comply with ransom demands.

Details of the alleged leak

According to the announcement made by the LockBit group, the breach involves highly sensitive information. The group has shared alleged administrative credentials and specific server directory paths within their public post. The presence of such credentials in a leak site announcement poses a significant security risk, as it provides potential attackers with direct pathways into the infrastructure.

The group claims that the stolen information includes data related to critical integrations, such as accounting software, ACH, and tax authority (DGI) systems. Furthermore, the announcement mentions that paths to server backup directories have been exposed. The specific items identified as being affected include:

• Administrative credentials
• Accounting data
• Server backup files

While the group has provided these details, it is important to note that these claims are made by the threat actor and have not been independently verified. The exposure of backup directories is particularly dangerous, as it can allow attackers to locate and manipulate historical data or identify further vulnerabilities within the storage architecture.

About payday.com.pa

PayDay is a service provider based in Panama that specializes in payroll and human resources management. The platform is designed to provide essential integrations for businesses, including connections to accounting software, time tracking systems, and ACH payment processes. Additionally, the tool facilitates integration with tax authorities, specifically the CSS and DGI.

Because the organization operates as a central hub for financial and administrative workflows, the integrity of its data is paramount to the businesses it serves. The nature of its services means that the platform handles sensitive financial information and personal data necessary for payroll and tax compliance.

Security implications and industry risks

The LockBit group is a well-known entity in the cybercrime landscape, recognized for its ransomware-as-a-service (RaaS) model. This model allows the group to operate by providing sophisticated ransomware tools to affiliates, who then carry out the actual attacks. This structure has allowed the group to remain active since 2019.

For a service provider like PayDay, a successful data leak carries significant risks. The potential exposure of financial and accounting data could place the sensitive information of its customers at risk. Such a breach may lead to identity theft and various fraud attempts targeting the institution's clients. Furthermore, such an incident may result in violations of data protection obligations under Panamanian law.

Organizations operating in the professional services and financial integration sectors should prioritize robust security measures to mitigate these risks. This includes implementing multi-factor authentication to protect against the use of stolen administrative credentials, maintaining strict access controls for server directories, and ensuring that backup files are stored in isolated, immutable environments. Continuous monitoring and regular security audits are also essential to detect unauthorized access to sensitive integration points before data exfiltration can occur.