LockBit Security Incident

From Wikipedia, the free encyclopedia Criminal hacking organization Lockbit Formation 2019 Type Cybercrime LockBit is a cybercriminal group proposing ransomware as a service (RaaS). Software developed by the group (also called ransomware ) enables malicious actors who are willing to pay for using it to carry out attacks in two tactics where they not only encrypt the victim's data and demand payment of a ransom , but also threaten to leak it publicly if their demands are not met. [ 1 ] According to a joint statement by various government agencies, LockBit was the world's most prolific ransomware in 2022. [ 2 ] It was estimated in early 2023 to be responsible for 44% of all ransomware incidents globally. [ 3 ] In the United States between January 2020 and May 2023, LockBit was used in approximately 1,700 ransomware attacks, with US$ 91 million paid in ransom to hackers. [ 2 ] Government agencies did not formally attribute the group to any nation-state. [ 4 ] Software with the name "LockBit" appeared on a Russian-language based cybercrime forum in January 2020. [ 2 ] The group is financially motivated. [ 3 ] However, in an interview on Inside Darknet, members claimed they are not Russian. [ 5 ] In February 2024 law enforcement agencies seized control of LockBit dark web sites used for attacks. [ 6 ] [ 7 ] However, further attacks with LockBit ransomware were later reported, with the group attempting to perform a comeback. [ 8 ] [ 9 ] In May 2025, the LockBit ransomware group's infrastructure was breached and defaced. The data breach resulted in a data dump, exposing Bitcoin wallet addresses, public encryption keys, internal chat logs with victims, affiliate details, and other sensitive information. [ 10 ] [ 11 ] Description [ edit ] LockBit software, written in the C and C++ programming languages until .NET was used for the LockBit-NG-Dev under development at takedown in 2024, [ 8 ] gains initial access to computer systems using purchased access, unpatched...

... (truncated for display)