LockBit 3.0 Ransomware Attack on Totto: Cyber Threats in the Fashion Industry
Incident Date:
May 9, 2024
Overview
Title
LockBit 3.0 Ransomware Attack on Totto: Cyber Threats in the Fashion Industry
Victim
Nalsani SAS (Totto)
Attacker
Lockbit3
Location
First Reported
May 9, 2024
Ransomware Attack on Nalsani SAS (Totto) by LockBit 3.0
Victim Overview
Nalsani SAS, operating under the brand Totto, is a Colombian company specializing in the production and distribution of fashion items such as backpacks, handbags, accessories, and more. The company stands out in the industry for its focus on sustainability, social responsibility, and offering a wide range of durable and stylish products for travel, school, and everyday use.
Company Profile
Totto is a significant industry player with a presence in over 57 countries and more than 600 stores worldwide. The company has over 374 marketing branches in Latin America and employs 1,784 individuals. Totto's eCommerce net sales are primarily generated in Colombia, with a focus on the Fashion category, particularly Bags & Accessories.
Attack Details
LockBit 3.0, a Ransomware-as-a-Service (RaaS) group, targeted Nalsani SAS (Totto) by infiltrating their website, totto.com. Instead of demanding a ransom, the attackers exfiltrated 56 GB of miscellaneous documents and released a sample of the leaked data. This attack showcases the evolving tactics of cybercriminals to exploit vulnerabilities in organizations.
Threat Actor Analysis
The ransomware group distinguishes itself by being an advanced variant of the LockBit ransomware, known for its encryption capabilities, obfuscation techniques, and lateral movement within networks. The group has targeted a wide range of businesses globally, including major companies like Boeing and ICBC. LockBit 3.0's modular and evasive nature makes it challenging to detect and defend against.
Company Vulnerabilities
The attacked company may have been targeted by threat actors due to its significant presence in the fashion industry, extensive network of stores, and online sales platform. The company's focus on sustainability and social responsibility could have made it a target for cybercriminals seeking to exploit sensitive data or disrupt operations.
LockBit May Attacks
This is part of the May 2024 attacks by LockBit 3.0, a cybercriminal group, resurfaced with vigor following the disruption of its infrastructure in February during "Operation Cronos." Despite arrests and the dismantling of its data leak site, LockBit swiftly returned, targeting over 50 victims within hours of reactivating its platform, with subsequent attacks adding to the tally. These assaults spanned various sectors and countries, showcasing LockBit's global reach and adaptability.
Sources:
- Bloomberg - Nalsani SAS Company Profile
- EcommerceDB - Totto Online Store
- Universidad de Bogotá - Totto Industry Presence
- EMIS - Nalsani SAS Company Revenue
- VMware - LockBit 3.0 Information
- SentinelOne - LockBit 3.0 Features
- Trend Micro - LockBit 3.0 Capabilities
- Times of India - LockBit 3.0 Targeted Companies
- Wazuh - Detecting LockBit 3.0 Ransomware
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.