blackandwhitecabs.com.au Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 15 February 2023, the Australian taxi operator blackandwhitecabs.com.au was listed on the leak site of the ransomware group known as lockbit3. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical detail about timing, method, or confirmed contents has not been disclosed.

The listing itself is a claim by the group. For customers, drivers, and staff who may have dealt with the company across its service areas, the incident raises ordinary questions about what information left the organisation’s systems and what practical steps follow.

Breaking down the breach

According to the available record, blackandwhitecabs.com.au appeared on lockbit3’s leak site on 15 February 2023. The reported summary associated with the listing includes a short message directed at management—“Dear management! change the negotiator, the conditions he offers are very funny!”—followed by promotional language describing the firm’s taxi and cab services in Brisbane, Perth, Toowoomba, Redcliffe, Maryborough and Mandurah. The record characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated.

No confirmed figure for affected individuals has been published. Exact dates of initial access, encryption, or data transfer, the volume of material taken, and any ransom demand or payment outcome are undisclosed in the public facts. The listing should be treated as an unverified claim by the group unless independently confirmed by the organisation or authorities.

Who is lockbit3?

LockBit 3 (also styled LockBit3 or LockBit Black) is a well-documented ransomware operation that has operated as a Ransomware-as-a-Service model. Affiliates gain access to victim networks, exfiltrate data, and deploy encryption, after which the group typically posts the victim on a dedicated leak site and threatens to publish stolen material if payment is not made. The group has been linked to numerous attacks on organisations worldwide across many sectors; its public leak sites and negotiation portals are part of a pressure strategy that combines encryption with the threat of data exposure.

In this case, lockbit3’s listing of blackandwhitecabs.com.au constitutes the group’s claim that it held and could release internal files. No additional statements from the group about this specific victim beyond the listing text and the characterisation of internal-file exfiltration are provided in the facts. Claims made on criminal leak sites are not independent verification.

About blackandwhitecabs.com.au

Blackandwhitecabs.com.au presents itself as a provider of taxi and cab services operating in several Australian locations, including Brisbane, Perth, Toowoomba, Redcliffe, Maryborough and Mandurah. Firms of this type typically manage booking systems, driver and vehicle records, customer contact details, payment or account information, and internal operational documents. They sit at the intersection of transport, local commerce, and personal data handling.

A breach involving such an organisation is consequential because it can touch both the people who book rides and the people who drive or administer the service. Even when the precise scope is unconfirmed, the combination of customer-facing and internal operational data makes the incident relevant to a broad set of individuals who may never have considered their taxi booking or employment records as high-value targets.

The information in question

The public facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No itemised list of data types—such as names, addresses, phone numbers, payment card details, driver licences, trip histories, or employee records—has been confirmed in the available record. Exact contents therefore remain unconfirmed.

Organisations in the taxi and cab sector commonly hold customer booking and contact data, driver identification and licensing information, vehicle and shift records, and internal administrative or financial files. Whether any or all of those categories were among the files claimed by lockbit3 is not established by the facts. Readers should treat specific data categories as possible rather than proven until the organisation or official sources provide clearer disclosure.

What's at stake

For individuals, the real-world risks centre on misuse of personal or contact information if it was among the exfiltrated files: unwanted contact, phishing that references a real booking or employment relationship, or attempts to socially engineer further access. Financial or identity-related harm depends entirely on what was actually taken—an unknown at present. For drivers or staff, internal files could include employment or licensing details that, if exposed, create longer-term privacy and fraud concerns.

For the organisation, the stakes include operational disruption from ransomware, potential regulatory attention under Australian privacy rules, loss of customer and driver trust, and the cost of investigation and remediation. Because the scale and precise contents are undisclosed, the full extent of these impacts cannot be measured from public facts alone. The incident nonetheless illustrates how ransomware groups use both encryption and the threat of publication to pressure victims.

If your data was in this claimed breach

If you have used blackandwhitecabs.com.au services, worked with the company, or otherwise shared information with it, practical first steps are straightforward and do not require panic.

• Treat unsolicited calls, messages, or emails that reference taxi bookings, accounts, or employment with the company as potentially suspicious; verify through official channels rather than links or numbers supplied in the message.
• Monitor bank and card statements for unfamiliar charges if you ever paid the firm electronically, and consider a credit or identity check if you later learn that financial or identity documents were involved.
• Change passwords on any accounts that reused credentials tied to the company’s services, and enable multi-factor authentication where available.
• Retain any booking confirmations or correspondence that may help you establish what data you originally provided.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets; this does not confirm or rule out inclusion in this specific incident but can surface other exposures worth addressing.

Public detail on this incident remains limited. Further clarity, if it comes, will most usefully come from the organisation itself or from official notifications. Until then, measured caution and basic hygiene are the proportionate response.

AICompiled with AI assistance from public sources and published under our editorial standards.