bigcenters.rs Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 12, 2022, the organization bigcenters.rs appeared on the leak site operated by the lockbit3 ransomware group. The group claims to have stolen internal data in a ransomware attack, though the number of people affected remains unknown and public detail on the incident is limited.

Listings of this kind signal that an attacker asserts control over an organization's files and may threaten to publish them. For anyone connected to bigcenters.rs—as a customer, employee, or partner—the claim raises practical questions about what information may now be outside the organization's control and what steps are worth taking while fuller details are unavailable.

What happened

According to the available record, bigcenters.rs was listed on the lockbit3 ransomware leak site on or around October 12, 2022. The group claims to have exfiltrated internal files during a ransomware attack. No confirmed figure for the number of people affected has been published, and the precise method of initial access, the duration of any intrusion, and the full scope of systems involved have not been disclosed in the public summary.

Ransomware incidents typically involve encryption of systems paired with data theft, after which the operators demand payment under threat of leaking the stolen material. In this case, the sole concrete public element is the leak-site listing itself and the accompanying claim of internal-file exfiltration. No independent confirmation of the volume or sensitivity of the data has been provided in the reported facts, and no statement from bigcenters.rs detailing containment or notification efforts appears in the given record.

Inside lockbit3

Lockbit3 is a well-documented ransomware operation that emerged as an evolution of earlier LockBit activity. The group functions as a ransomware-as-a-service enterprise: core developers maintain the malware and leak infrastructure while affiliates carry out intrusions in exchange for a share of any ransom. Its typical playbook includes initial access through phishing, exploited vulnerabilities, or compromised remote-access credentials, followed by lateral movement, data staging and exfiltration, and finally deployment of encryptors.

Lockbit3 has historically maintained a public leak site where it names victims and, if unpaid, publishes samples or full archives of stolen data. The group has targeted organizations across many sectors and geographies, often emphasizing speed and volume of attacks. Because leak-site posts are controlled by the attackers, they constitute claims rather than verified disclosures; victims sometimes negotiate, sometimes refuse, and sometimes dispute the accuracy or completeness of what is asserted. Nothing in the public facts beyond the listing itself confirms the specific allegations lockbit3 has made about bigcenters.rs.

Who is bigcenters.rs?

bigcenters.rs is an organization operating under a Serbian top-level domain. Public detail about its exact corporate structure, size, or service lines is sparse in the breach record. Entities with similar naming and domain patterns commonly function as commercial or service businesses—potentially involving retail, logistics, customer-support centers, or related operations—that maintain internal administrative files, employee records, and customer or partner information as a routine part of doing business.

A breach affecting such an organization is consequential because even modest internal file sets can contain personally identifiable information, contractual documents, financial records, or operational details. Individuals who have interacted with the company may have supplied contact data, identification details, or payment-related information in the ordinary course of a relationship. Until the organization or independent investigators clarify the holdings, the potential reach of any exposure remains an open question rather than a settled fact.

The information in question

The reported facts state that internal files were exfiltrated in the ransomware attack. No further breakdown—such as whether the material included employee databases, customer lists, financial spreadsheets, authentication credentials, or intellectual property—has been disclosed. The number of individuals whose data may be involved is explicitly unknown.

Organizations of this general type typically hold personnel files, billing or order records, correspondence, and system configuration data. Any of those categories can surface in an internal-file theft. Because the exact contents remain unconfirmed, it is not possible to state with certainty which specific data elements were taken or whether they have been published. The lockbit3 claim should be treated as an unverified assertion pending additional evidence or official notification.

What's at stake

For individuals, the primary risks are opportunistic misuse of personal details if those details were present in the stolen files. That can include targeted phishing that references real relationships or account information, attempts at identity fraud, or credential stuffing against other services where passwords may have been reused. Even when data is limited to names and contact details, the information can make social-engineering attempts more convincing.

For the organization, consequences include operational disruption from any encryption event, potential regulatory notification duties, reputational damage, and the cost of investigation and remediation. Because the scale is undisclosed, the practical impact could range from contained internal exposure to broader customer or partner notification requirements. Uncertainty itself creates friction: people connected to bigcenters.rs cannot yet gauge their personal exposure with precision, which is why cautious monitoring remains advisable.

What to do if you're exposed

If you have a past or present relationship with bigcenters.rs, treat the situation as a prompt for basic hygiene rather than panic. Change passwords on any accounts that may have overlapped with the organization, especially if you reused credentials elsewhere, and enable multi-factor authentication wherever it is offered. Monitor financial statements and account activity for unfamiliar transactions. Be skeptical of unexpected messages that claim to relate to the incident and request personal information or payments; verify such contacts through official channels you already trust.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Remaining alert to official updates from the organization itself is the most direct way to learn whether notification thresholds have been met and whether specific data categories have been confirmed as involved.

AICompiled with AI assistance from public sources and published under our editorial standards.