Uniter.net listed on LockBit3 leak site

• Ransomware group: Lockbit3
• Country: Spain
• Sector: Technology
• Announcement date: May 9, 2024

LockBit3 claims data breach at uniter.net

The LockBit ransomware group has listed uniter.net, a provider of textile labelling solutions, on its leak site. This announcement marks a new addition to the group's list of targets, claiming that the organization has been compromised by their operations.

According to the threat actor, the listing was created to support the claim that the organization was subjected to a cyberattack on March 19, 2024. The group announced on May 9, 2024, that it has leaked data belonging to uniter.net on its leak site. To support their claims of having gained access to the organization's networks, the threat actor has shared various documents as proof of the intrusion.

Details of the alleged data leak

While the specific volume of the stolen data and the exact ransom demand remain unknown, the group has provided screenshots as evidence of the breach. The samples shared in these screenshots include a variety of sensitive business documents that provide insight into the company's internal operations and logistics.

The documents identified in the shared samples include:

• Commercial invoices
• Order forms
• Shipment documents
• Certification documents

The presence of such documentation suggests that the attackers have accessed files related to the company's commercial transactions and supply chain management.

About uniter.net

Uniter is a Spanish company that provides textile labelling solutions for the clothing, footwear, and accessories industries. The firm manufactures woven labels, printed labels, and various authentication products for brands.

Analysis and implications of the incident

The allegedly leaked data may contain sensitive information regarding the organization's commercial operations and supply chain relationships. Because the organization is based in Spain, this situation may lead to legal obligations under the European Union's General Data Protection Regulation (GDPR). The commercial data contained in the shared documents could potentially facilitate targeted phishing or fraud attempts by third parties.

The LockBit group is a Ransomware-as-a-Service (RaaS) provider that has been active since 2019. It is worth noting that the group's continued activity, despite international law enforcement operations in February 2024, may indicate the group's operational resilience. This resilience highlights the ongoing challenges faced by defenders against established ransomware ecosystems.

In such scenarios, organizations often face the dilemma of double extortion, where attackers not only encrypt data but also threaten to leak it to pressure the victim into paying. When a breach is suspected, it is often advisable for the organization to initiate data breach notification processes and inform affected business partners to mitigate potential downstream impacts. Strengthening network monitoring and implementing strict access controls are common defensive measures used to prevent such unauthorized access to sensitive commercial and certification documentation.