bigc.co.th Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 April 2023, the ransomware group known as lockbit3 listed bigc.co.th on its leak site, claiming a ransomware attack in which internal files were exfiltrated. Public reporting does not state how many people were affected, the precise date of intrusion, or a confirmed inventory of every file taken. What is known is limited to the listing itself and the characterisation of the material as internal files from a major Thai retail operator.

For customers, staff and partners of a large grocery and hypermarket chain, any confirmed or claimed theft of internal data raises practical questions about what may have left the organisation and what steps are worth taking while fuller detail remains unavailable.

Breaking down the breach

According to available records, bigc.co.th was listed by lockbit3 on or around 24 April 2023. The group’s claim describes a ransomware attack in which internal files were exfiltrated. No public figure has been given for the number of people affected. The method of initial access, the duration of any dwell time inside the network, whether encryption was also deployed, and whether a ransom demand was paid or refused are all undisclosed in the material provided.

Because the primary public signal is a leak-site listing, the incident should be treated as an unverified claim by the threat actor unless and until the organisation or independent investigators state the scope. No dollar amounts, file counts, or sample document titles beyond the general description “internal files” appear in the reported facts.

Inside lockbit3

LockBit 3 (also referred to as LockBit Black in public reporting) is a well-documented ransomware operation that has used a Ransomware-as-a-Service model. Affiliates gain access to victim networks, move laterally, exfiltrate data, and often deploy encryption, after which the operators pressure victims by threatening to publish stolen material on a dedicated leak site. The group has been associated with numerous high-profile incidents across many countries and sectors; its public sites have historically listed victims, countdown timers, and, in some cases, sample files to increase leverage.

Typical tactics reported in open sources include exploitation of exposed remote-access services or unpatched vulnerabilities, use of stolen credentials, disabling of backups and security tools, and double-extortion (theft plus encryption). None of these general patterns should be read as confirmed steps in the bigc.co.th case; they describe how the group has operated elsewhere. For this incident, the only actor-specific claim in the facts is the leak-site listing asserting that internal files were taken.

Who is bigc.co.th?

Big C is a grocery and general-merchandising retailer headquartered in Bangkok, Thailand. As of 2016 it was described as Thailand’s second-largest hypermarket operator after Lotus’s, with operations reported in Thailand, Vietnam, Laos and Cambodia. Organisations of this type run large store networks, supply chains, loyalty and payment systems, e-commerce channels, and substantial back-office functions covering employees, suppliers and customers.

A breach claim against such a retailer matters because the business necessarily processes and stores operational, commercial and personal information at scale. Even when the exact contents of a claimed exfiltration remain unconfirmed, the sector’s data footprint means that staff records, supplier contracts, internal financial or logistics documents, and customer-related systems are among the categories that could, in principle, be implicated—without any of those categories being verified as taken in this specific case.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No further breakdown—such as customer databases, payment card data, employee HR files, or specific document types—is provided. The number of people affected is listed as unknown. Therefore any statement about exact contents would be speculation.

Retailers of Big C’s size typically hold, among other things, employee personal and payroll data, supplier and contract information, internal financial and inventory records, store-operations documents, and customer information tied to loyalty, delivery or online accounts. Whether any of those categories were among the files lockbit3 claims to have taken has not been publicly confirmed in the given record. Readers should treat the exposure as limited to what the actor asserts until official clarification appears.

The real-world impact

For individuals, the main risks when internal corporate files are stolen are secondary misuse of any personal data that may have been included—phishing that references real internal details, identity or account fraud if identifiers or contact data were present, and targeted social engineering against staff or suppliers. Because the people-affected count and data types beyond “internal files” are unknown, it is not possible to say how widely those risks apply.

For the organisation, a public ransomware listing can disrupt operations, force incident-response and legal costs, damage supplier and customer trust, and create regulatory attention under applicable Thai and regional data-protection rules. Recovery complexity depends on whether systems were encrypted, how intact backups were, and how quickly access paths were closed—all of which remain undisclosed here. No negligence or root cause has been established in the public facts.

Were you affected?

If you are a customer, employee or partner of Big C, concrete next steps remain useful even while the full scope is unconfirmed:

• Treat unexpected emails, messages or calls that reference Big C, invoices, or internal projects with caution; verify through official channels before clicking links or sharing codes.
• Change passwords on any accounts that reused credentials tied to work or retail logins, and enable multi-factor authentication where available.
• Monitor bank and card statements for unfamiliar charges if you have used payment methods at the retailer.
• Watch for phishing that uses accurate personal or employment details, which can appear months after an incident.
• Prefer official Big C or regulator notices over social-media rumours when seeking updates.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not prove or disprove involvement in this specific incident, but it can show whether your address is circulating in other leaked collections and help you prioritise password and account hygiene.

AICompiled with AI assistance from public sources and published under our editorial standards.