8x8.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In late 2022 the ransomware ecosystem continued to treat corporate networks as both ransom targets and sources of data for public pressure. Against that backdrop, the communications provider 8x8 appeared on the leak site operated by the group known as lockbit3. The listing, reported on 2 December 2022, asserted that internal files had been taken; the number of people affected remains unknown and independent confirmation of the full scope has not been made public.

For customers, employees and partners of a company that handles voice, video and messaging traffic, any claim of internal-file theft raises immediate questions about what may have left the network and who might be exposed. Public detail is limited to the group’s own statement, so the incident must be examined strictly on what has been reported rather than on speculation.

Inside the incident

On 2 December 2022, 8x8.com was listed on the lockbit3 ransomware leak site. According to the reported summary, the group claims to have stolen internal data in a ransomware attack and to have exfiltrated internal files. No figure for the volume of data, no list of specific file names, and no confirmed count of affected individuals have been released in the available record. The precise method of initial access, the duration of any presence inside the network, and whether a ransom demand was issued or paid are all undisclosed. What is known is confined to the appearance of the organisation on the leak site and the group’s assertion that internal files were taken.

Inside lockbit3

Lockbit3 is the name used by a prolific ransomware operation that has been active for several years in successive versions. The group typically gains access to victim networks, exfiltrates data, encrypts systems, and then posts the victim’s name on a dedicated leak site if payment is not received. Its public leak site serves both as a pressure mechanism and as a distribution channel for stolen files. Lockbit affiliates have historically targeted organisations across many sectors, using double-extortion tactics that combine encryption with the threat of data publication. In this case the group claims to have stolen internal data from 8x8; that claim originates from the leak-site listing itself and has not been independently verified in the facts available. No further statements attributed to lockbit3 about this specific victim appear in the record.

8x8 and its sector

8x8 is a provider of cloud-based business communications services, including voice, video conferencing, contact-centre and messaging platforms. Companies in this sector routinely process call detail records, account credentials, configuration data, customer contact information and internal operational documents. Because these services sit at the centre of day-to-day business communication, a breach affecting an operator of this type can have consequences that extend beyond the company itself to the organisations and individuals who rely on its platforms. The appearance of such a provider on a ransomware leak site is therefore consequential even when the precise contents of any stolen material remain unconfirmed.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as employee records, customer databases, source code or financial documents—has been publicly named. Organisations that supply cloud communications platforms typically hold a mixture of operational files, system logs, customer account data and internal correspondence. Whether any of those categories were among the files the group claims to have taken is unconfirmed. Readers should treat the exposure as limited to the broad description “internal files” until additional verified detail emerges.

What's at stake

For individuals whose information may have been present in internal files, the practical risks include unwanted contact, credential stuffing against other accounts, or social-engineering attempts that reference genuine internal details. For the organisation, the stakes include potential regulatory scrutiny, contractual obligations to notify customers, and the operational cost of investigating and containing the incident. Because the number of people affected is unknown and the exact data types beyond “internal files” are not disclosed, the scale of these risks cannot be quantified from public information alone. The incident nonetheless illustrates how ransomware groups use the mere listing of a victim to create uncertainty and pressure.

What to do if you're exposed

If you have an account or working relationship with 8x8, or if you believe your details may have been stored in its internal systems, the following steps are prudent:

• Change passwords on any related accounts and enable multi-factor authentication where available.
• Monitor financial and email accounts for unexpected activity or password-reset attempts.
• Treat unsolicited messages that reference 8x8 or internal business details with caution, as they may be social-engineering attempts.
• Request an official notification or status update from the company if you are a customer or employee.
• Run a free exposure scan of your email address to check whether it has appeared in known breach data sets.

Public information about this incident remains limited to the lockbit3 listing and the claim of internal-file exfiltration. Continuing to follow official statements from 8x8 is the most reliable way to learn whether additional Reported Details become available.

AICompiled with AI assistance from public sources and published under our editorial standards.