1.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 29 March 2023, the organisation 1.com appeared on a leak site operated by the ransomware group known as lockbit3. The listing asserts that internal files were taken during a ransomware attack. How many people may be affected remains unknown, and public detail about the precise contents of those files is limited. For anyone who has used 1.com’s services, the practical stake is straightforward: material that an organisation of this kind routinely holds could, if it has left the company’s control, be misused for fraud, impersonation or further intrusion.

This account sets out only what has been reported, places the claim in the context of the group that made it, and outlines the concrete steps people can take while fuller confirmation is still absent.

What happened

According to the available record, 1.com was listed by the lockbit3 ransomware group on or about 29 March 2023. The group’s claim is that internal files were exfiltrated in a ransomware attack. No figure for the number of people affected has been published. The method of initial access, the duration of any intrusion, and whether a ransom demand was issued or paid are all undisclosed. The only concrete description supplied is that internal files were taken; beyond that single characterisation, public detail is limited.

Because the information originates from a criminal leak-site listing rather than from a confirmed disclosure by the organisation itself, the episode should be treated as an unverified claim until independent verification appears. No additional technical indicators, file counts or sample data have been released in the material provided for this report.

Inside lockbit3

Lockbit3 is the name used by a long-running ransomware operation that has appeared repeatedly in public reporting since earlier versions of the same brand. Groups operating under the LockBit banner typically gain access to a victim network, move laterally, exfiltrate data, and then encrypt systems while threatening to publish the stolen material if payment is not made. The “3” designation refers to a later iteration of their toolkit and leak-site infrastructure.

Like other ransomware crews, lockbit3 has historically maintained a public blog on which it names organisations it claims to have compromised and, in some cases, posts samples or larger archives of data. Listings are therefore assertions by the actors themselves; they are not independent confirmations. The group has been linked to attacks across many sectors and jurisdictions, often using double-extortion tactics that combine encryption with the threat of data exposure. None of that general pattern, however, supplies specific proof about the 1.com incident beyond the bare fact of the listing and the claim of internal-file exfiltration.

About 1.com

1.com operates in the domain-name and web-hosting sector. Organisations of this type commonly manage customer domain registrations, DNS records, hosting accounts, billing details and technical support communications. They sit at a sensitive point in the internet ecosystem: a compromise can affect not only the company’s own staff and systems but also the online presence of the customers who rely on those services.

A breach claim against such a provider is consequential precisely because of that intermediary role. Even when the exact scope remains unconfirmed, the possibility that internal operational files or customer-related records have left the organisation’s control raises immediate questions for anyone who has entrusted domain or hosting data to the company. Public reporting has not established negligence or specific security failures; it has only recorded the lockbit3 listing.

The information in question

The sole description given is that internal files were allegedly exfiltrated in a ransomware attack. No inventory of file types, no confirmation of customer databases, and no statement about credentials, financial data or personal identifiers have been supplied. The number of people affected is explicitly unknown.

Organisations in the domain and hosting sector typically hold account credentials, contact and billing information, domain-registration records, support tickets and internal operational documents. Whether any of those categories were among the files lockbit3 claims to have taken is unconfirmed. Until a fuller disclosure appears, it is accurate only to say that internal material is alleged to have been copied and that the precise contents remain undisclosed.

Why it matters

For individuals and businesses that use 1.com, the immediate risk is that any exposed internal files could contain information useful for targeted phishing, account takeover or social-engineering attacks. Even routine administrative documents can reveal naming conventions, internal contacts or system details that criminals later exploit. Because the scale is unknown, it is impossible to judge how widely those risks may extend.

For the organisation itself, a public ransomware listing can damage trust, trigger regulatory scrutiny and impose recovery costs, regardless of whether the claim is ultimately substantiated in full. Customers may need to monitor their own domains, email accounts and payment methods more closely until clearer information emerges. The absence of confirmed numbers does not eliminate the need for caution; it simply means the response must be proportionate and based on what is actually known.

What to do if you're exposed

If you have an account or domain registered through 1.com, treat the lockbit3 claim as a prompt for basic hygiene rather than proof that your personal data has already been published. Practical first steps include:

• Change the password on your 1.com account and on any email address used for that account, using a unique password not reused elsewhere.
• Enable multi-factor authentication wherever the service offers it.
• Review recent account and domain activity for unrecognised changes to DNS, name servers, forwarding or billing details.
• Watch for phishing messages that reference the breach or urge urgent “verification” of your domain or hosting account.
• Monitor financial statements and credit activity if you have stored payment methods with the provider.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Continue to follow official statements from 1.com should any be issued. Public detail on this incident remains limited; measured personal precautions are the most useful response available while that remains the case.

AICompiled with AI assistance from public sources and published under our editorial standards.