at-global.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 22 June 2024, the ransomware group known as lockbit3 listed at-global.com on its leak site, claiming responsibility for a ransomware attack that involved the exfiltration of internal files. Public reporting indicates the group asserted it had taken more than 500 GB of data and provided a mega.nz link as evidence of the haul. The number of people affected remains unknown, and independent confirmation of the full scope has not been published.

The listing matters because it places a company operating under the at-global.com domain—and, according to the group’s own wording, connected to Allied Telesis network infrastructure—into the public record of claimed ransomware victims. Until further verified details emerge, the incident rests on the group’s unverified assertions and the limited facts that have been reported.

Inside the incident

According to the lockbit3 listing reported on 22 June 2024, the group claimed it had compromised the network of the company associated with www.alliedtelesis.com and extracted data linked to www.at-global.com. The post stated that the company maintained offices in America (three locations), Europe, Asia, China, Singapore and elsewhere. The group further claimed to have exfiltrated more than 500 GB of internal files and published a mega.nz folder link as purported proof.

No independent forensic timeline, exact entry vector, or confirmed encryption of systems has been disclosed in the available facts. The volume of data, the precise systems accessed, and whether any ransom demand was paid remain unconfirmed beyond the group’s own statements. Public detail on the technical method of intrusion is therefore limited to the claim of network access and data theft.

Inside lockbit3

Lockbit3 is a well-documented ransomware-as-a-service operation that has been active for several years. The group typically gains initial access through phishing, exploited vulnerabilities or compromised credentials, then deploys ransomware that encrypts systems while simultaneously exfiltrating data for double-extortion leverage. Victims who refuse to pay are listed on the group’s dedicated leak site, where sample files or full archives are sometimes published to pressure payment.

Lockbit3 has previously claimed attacks against organisations across manufacturing, technology, logistics and professional services. Its operators maintain a reputation for rapid data theft and public shaming tactics. In this case the group claims to have listed at-global.com after taking internal files; that listing itself constitutes an unverified claim rather than independently confirmed attribution.

at-global.com and its sector

at-global.com appears in the reported listing as the domain associated with the claimed victim. The lockbit3 post explicitly linked the target to Allied Telesis, a long-established provider of networking hardware, switches, routers and related infrastructure solutions used by enterprises, governments and service providers worldwide. Companies in this sector typically maintain design documents, customer configuration data, supply-chain records, employee information and proprietary technical files.

A breach affecting an organisation of this type is consequential because networking vendors sit at the centre of many customers’ digital infrastructure. Exposure of internal files can reveal product roadmaps, customer lists, support credentials or operational details that adversaries could later misuse. Even when the precise contents remain unconfirmed, the sector’s role in global connectivity elevates the potential downstream risk.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in a ransomware attack.” The group claimed a volume exceeding 500 GB. Exact file inventories, whether customer records, source code, financial documents or employee data were included, and any confirmation of personal information have not been disclosed.

Organisations operating in the networking and technology sector commonly hold:

• Internal technical documentation and product designs
• Customer and partner contact lists or configuration data
• Employee records and corporate communications
• Financial, legal and supply-chain files

Because the facts do not itemise the contents, any assertion about specific categories beyond “internal files” remains unconfirmed. Readers should treat the mega.nz link and the 500 GB claim as assertions made by the threat actor rather than verified inventories.

The real-world impact

For individuals whose data may have been among the internal files, the primary risks are identity-related misuse, targeted phishing that references genuine corporate details, and potential credential stuffing if any login information was present. Because the number of people affected is unknown and the precise data types are unconfirmed, the scale of personal exposure cannot yet be quantified.

For the organisation itself, the consequences include operational disruption if systems were encrypted, reputational damage from the public listing, possible regulatory scrutiny depending on jurisdiction, and the cost of investigation and remediation. Customers and partners of a networking vendor may also face secondary risk if configuration details or support credentials were among the taken files. All such impacts remain contingent on verification of what was actually stolen.

Were you affected?

If you have ever worked with, supplied, or been a customer of at-global.com or Allied Telesis, treat the claim as a prompt for caution rather than confirmed compromise. Practical first steps include changing passwords used on related accounts, enabling multi-factor authentication where available, monitoring financial and email accounts for unusual activity, and remaining alert to phishing messages that reference the company by name.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan does not prove involvement in this specific incident, but it provides an immediate, low-effort way to assess whether personal credentials have previously surfaced elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.