atpformosa.gob.ar Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 29, 2024, the ransomware group known as lockbit3 listed atpformosa.gob.ar on its leak site, claiming to have carried out an attack against the organization. Public reporting identifies the entity as the Administración Tributaria Provincial (Dirección General de Rentas de Formosa), the Formosa Tax Administration based in Formosa, Argentina. The number of people affected remains unknown, and available details describe the exposure as internal files exfiltrated in a ransomware attack.

This listing matters because it involves a provincial government tax authority that handles sensitive administrative and financial records. While the full scope of any compromise has not been independently confirmed, the claim alone raises practical concerns for residents, businesses, and officials who interact with the agency.

Breaking down the breach

According to the reported listing dated November 29, 2024, lockbit3 posted atpformosa.gob.ar as a new victim. The group’s own statement on the leak site greets readers and identifies the organization as “Administracion Tribunaria Provincal (Dirección General de Rentas de Formosa),” describing it as the Formosa Tax Administration with headquarters at Ayacuch 810, Formosa, Argentina, and referencing its website. The facts state that internal files were exfiltrated in a ransomware attack. No further public detail has been provided on the precise timing of the intrusion, the technical method used, the volume of data taken, or any ransom demand. The number of individuals potentially affected is listed as unknown. Because the information originates from the group’s leak-site claim, it should be treated as an unverified assertion until corroborated by official sources or independent investigation.

Who is lockbit3?

Lockbit3 is a well-documented ransomware operation that has operated as a ransomware-as-a-service platform. In this model, core developers supply malware and infrastructure to affiliates who carry out individual attacks; profits are typically shared. The group is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Lockbit3 and its predecessors have claimed responsibility for numerous high-profile incidents across government, healthcare, manufacturing, and professional services sectors worldwide. Affiliates often gain initial access through phishing, exploited vulnerabilities, or compromised remote-access credentials, then move laterally before deploying the ransomware. The group maintains a public leak site where it posts victim names, company descriptions, and, in some cases, samples of stolen data to pressure negotiations. Its listing of any particular organization, including this one, constitutes a claim by the actors rather than independently verified fact.

About atpformosa.gob.ar

atpformosa.gob.ar is the online presence of the Administración Tributaria Provincial, also referred to as the Dirección General de Rentas de Formosa. This is the provincial tax administration for Formosa Province in Argentina. Such agencies are responsible for assessing, collecting, and administering provincial taxes, including property, income, and other local levies. They routinely process filings from individuals and businesses, maintain taxpayer registries, issue certificates, and handle enforcement matters. Because they sit at the intersection of government revenue and citizen financial data, tax administrations typically hold large volumes of personal identifiers, financial records, and internal administrative documents. A claimed breach of this type of organization is consequential: it can disrupt public services, undermine confidence in official systems, and place sensitive information at risk of misuse. The headquarters address listed by the group is Ayacuch 810, Formosa, Argentina.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. No specific data types beyond that description—such as names, national identity numbers, tax returns, bank details, or employee records—have been publicly named or confirmed. Organizations of this kind ordinarily maintain taxpayer databases, correspondence, internal reports, and operational documents. However, the exact contents of any files allegedly taken remain unconfirmed. Public detail is limited to the group’s claim of internal-file exfiltration; no inventory, sample set, or official confirmation of the data has been released in the reported information.

Why it matters

For people who have dealt with the Formosa Tax Administration—filing returns, paying provincial taxes, or corresponding with the agency—the primary risk is that personal or financial details could be exposed if the claim proves accurate. Even limited internal files can contain enough information to enable identity misuse, targeted phishing, or social-engineering attempts that reference real tax matters. For the organization itself, a ransomware incident can interrupt tax-collection systems, delay services to the public, and require costly recovery and forensic work. Because the number of people affected is unknown and the precise data unconfirmed, the practical impact cannot yet be quantified, but the nature of a tax authority means any confirmed exposure would carry concrete consequences for both residents and provincial administration. Attribution rests solely on the lockbit3 listing; independent verification would be needed to establish the full extent of any compromise.

Were you affected?

If you have interacted with the Formosa Tax Administration or used services linked to atpformosa.gob.ar, treat the situation with measured caution. Monitor official communications from the agency for any confirmed notices. Review recent financial and tax-related accounts for unexpected activity, and be alert to phishing messages that reference tax filings or provincial payments. Change passwords on related accounts if you reuse credentials, and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Until more details are confirmed by authorities, these steps provide a practical baseline for reducing personal risk.

AICompiled with AI assistance from public sources and published under our editorial standards.