Siqueiracastro listed on LockBit3 leak site

• Ransomware group: LockBit3
• Country: Brazil
• Sector: Professional Services
• Announcement date: February 22, 2023

The LockBit3 ransomware group has listed the Brazilian law firm Siqueiracastro on its dedicated leak site. According to the announcement made on February 22, 2023, the threat actor group claims to have successfully exfiltrated a significant volume of data belonging to the organization.

The alleged attack and data theft

The claim made by the LockBit3 group suggests that the breach occurred on February 22, 2023. The group has announced that they have obtained a total of 470 GB of data from the institution. The announcement regarding the publication of this data has already been made on the group's platform.

While the group has made these claims, no screenshots have been provided to verify the contents of the stolen information. Furthermore, no specific information was provided regarding a ransom demand or the organization's response to the incident. The group's listing serves as a notification of the alleged breach and the intent to release the gathered information.

Details of the claimed stolen data

The information allegedly stolen by the attackers is described as being highly sensitive, given the nature of the victim organization. The group claims to have access to various types of documentation that could be used for malicious purposes. The specific categories of data mentioned in the claim include:

• Financial records
• Accounting data
• Corporate reports
• Contracts

The theft of such documentation often involves a variety of file formats, though the specific file count was not disclosed in the announcement.

About Siqueiracastro

Siqueiracastro is a full-service law firm based in Brazil. The firm provides comprehensive legal consulting and advocacy services to its clients. Their professional operations span across various practice areas, ranging from corporate law to tax law, making them a central point for diverse legal and financial documentation.

Potential impact and organizational considerations

This alleged leak may pose a significant risk of exposing sensitive client information held by the law firm. Such an incident could lead to a loss of trust among the firm's clients and may result in legal sanctions under Brazil's data protection law, LGPD. The leaked data could potentially be used for identity theft or targeted phishing attacks against third parties.

The LockBit3 group has historically employed double-extortion strategies. In a double-extortion scenario, attackers not only encrypt the victim's systems to disrupt operations but also steal sensitive data to threaten the victim with its public release. This method increases the pressure on organizations to comply with ransom demands to prevent reputational damage and regulatory scrutiny.

For organizations operating in the professional services sector, such incidents highlight the necessity of robust data protection frameworks. General defensive steps for organizations facing such threats include maintaining rigorous backup protocols, implementing multi-factor authentication, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. Given the potential for legal consequences under frameworks like the LGPD, maintaining strict compliance and data governance is essential for mitigating the fallout of a potential breach.