business.gov.om Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The business.gov.om Listed by lockbit2 Ransomware Group (reported June 20, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
On June 20, 2022, the domain business.gov.om appeared on a leak site operated by the ransomware group lockbit2. The listing indicated that internal files had been taken during a ransomware incident, though the number of people or entities affected and the precise contents of any data remain undisclosed in public reporting.
The appearance of a government-operated business portal on such a site raises questions about the handling of official records in Oman, even when the full scope of the incident is not yet confirmed.
What happened
Public records show only that business.gov.om was added to the lockbit2 leak site on the reported date. The group stated that internal files had been exfiltrated. No official statement from the organisation has detailed the timeline of the intrusion, the method of access, or the volume of data involved. The number of individuals or businesses potentially affected is listed as unknown.
Who is lockbit2?
LockBit, also tracked as lockbit2 in its second major iteration, is a ransomware operation that first gained prominence in 2020. The group typically deploys encryption on victim systems and then threatens to publish stolen files unless a ransom is paid. It maintains a public leak site where it lists organisations it claims to have compromised. The group has been linked to attacks on entities in multiple countries and sectors, using affiliates who carry out intrusions in exchange for a share of payments. Any specific claim about business.gov.om originates solely from the group’s own site and has not been independently verified in official disclosures.
About business.gov.om
Business.gov.om serves as the primary online platform for company registration, licensing, and related administrative services in Oman. It is operated under government authority and processes records that include business ownership details, commercial registrations, and supporting documentation submitted by companies and individuals. Such portals routinely hold identifying information tied to legal entities and their representatives, making them repositories of structured administrative data rather than general consumer platforms.
What was likely exposed
The only data category referenced in connection with the listing is “internal files exfiltrated in ransomware attack.” No inventory of specific document types, databases, or record counts has been released. Organisations of this type commonly store corporate registration forms, shareholder information, licensing correspondence, and internal operational documents. The exact contents of any exfiltrated material remain unconfirmed beyond the general description provided by the listing.
Why it matters
Exposure of internal government files can affect the confidentiality of business records that underpin commercial activity in Oman. Even without confirmed personal data, the release of registration or licensing documents could create secondary risks such as targeted fraud or misuse of official information. For the organisation, the incident highlights the operational impact of ransomware on public digital services, regardless of whether ransom demands were met.
If your data was in this claimed breach
Individuals or companies concerned about possible exposure should monitor official communications from Omani government portals and their own business registration accounts for any unusual activity. Basic steps include reviewing recent login records, enabling or strengthening multi-factor authentication on related services, and watching for unsolicited contact that references registration details. Readers can also run a free exposure scan of their email address against known breach data sets to check for appearances in previously published collections.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
oak-brook.org Listed by lockbit2 Ransomware Groupdgi.gouv.ml Listed by lockbit2 Ransomware Grouphttps://www.dgi... Listed by lockbit2 Ransomware Groupsesver.gob.mx Listed by lockbit2 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the business.gov.om Listed by lockbit2 Ransomware Group →
Publicly posted by lockbit — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.