LockBit 3.0 Ransomware Attack on Totto: Cyber Threats in the Fashion Industry

Incident Date: May 09, 2024

Attack Overview
VICTIM
Nalsani SAS (Totto)
INDUSTRY
Retail
LOCATION
Colombia
ATTACKER
Lockbit
FIRST REPORTED
May 9, 2024

Ransomware Attack on Nalsani SAS (Totto) by LockBit 3.0

Victim Overview

Nalsani SAS, operating under the brand Totto, is a Colombian company specializing in the production and distribution of fashion items such as backpacks, handbags, accessories, and more. The company stands out in the industry for its focus on sustainability, social responsibility, and offering a wide range of durable and stylish products for travel, school, and everyday use.

Company Profile

Totto is a significant industry player with a presence in over 57 countries and more than 600 stores worldwide. The company has over 374 marketing branches in Latin America and employs 1,784 individuals. Totto's eCommerce net sales are primarily generated in Colombia, with a focus on the Fashion category, particularly Bags & Accessories.

Attack Details

LockBit 3.0, a Ransomware-as-a-Service (RaaS) group, targeted Nalsani SAS (Totto) by infiltrating their website, totto.com. Instead of demanding a ransom, the attackers exfiltrated 56 GB of miscellaneous documents and released a sample of the leaked data. This attack showcases the evolving tactics of cybercriminals to exploit vulnerabilities in organizations.

Threat Actor Analysis

The ransomware group distinguishes itself by being an advanced variant of the LockBit ransomware, known for its encryption capabilities, obfuscation techniques, and lateral movement within networks. The group has targeted a wide range of businesses globally, including major companies like Boeing and ICBC. LockBit 3.0's modular and evasive nature makes it challenging to detect and defend against.

Company Vulnerabilities

The attacked company may have been targeted by threat actors due to its significant presence in the fashion industry, extensive network of stores, and online sales platform. The company's focus on sustainability and social responsibility could have made it a target for cybercriminals seeking to exploit sensitive data or disrupt operations.

LockBit May Attacks

This is part of the May 2024 attacks by LockBit 3.0, a cybercriminal group, resurfaced with vigor following the disruption of its infrastructure in February during "Operation Cronos." Despite arrests and the dismantling of its data leak site, LockBit swiftly returned, targeting over 50 victims within hours of reactivating its platform, with subsequent attacks adding to the tally. These assaults spanned various sectors and countries, showcasing LockBit's global reach and adaptability.

Sources:

Disclaimer

The Halcyon Attacks Lookout Database is compiled using publicly available information based on the hosting choices of real-world threat actors and data from a variety of trackers. This information is provided in accordance with principles of fair use. Halcyon has made reasonable efforts to sanitize and verify the data; however, we do not guarantee the accuracy, completeness, or reliability of the information provided. Updates to the database are made as new source data becomes available from reputable sources.  By accessing, viewing, or using the information within the Halcyon Attacks Lookout Database, you acknowledge and agree to do so entirely at your own risk. No reliance should be placed upon the information for decision-making, and Halcyon disclaims all liability for any inaccuracies or omissions in the data.

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.