calvia.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a local government website appears on a ransomware group's leak site, the people who live, work, or interact with that municipality face immediate practical questions: whether their personal details, service records, or communications with the council may have been taken, and what that could mean for identity fraud, privacy, or disruption of everyday public services. On 13 January 2024, calvia.com—the online presence of the Ajuntament de Calvià—was listed by the LockBit3 ransomware group, which claimed that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail about the precise contents of those files is limited.

For residents of Calvià and anyone who has used the council's electronic registry, services, or online channels, the listing is a signal to treat the possibility of exposure seriously even while many specifics stay unconfirmed. This article sets out only what is known from the reported listing, places it in the context of how LockBit3 typically operates, and outlines the concrete risks and first steps that follow.

What happened

According to the reported summary, calvia.com was listed by the LockBit3 ransomware group on 13 January 2024. The listing states that internal files were exfiltrated in a ransomware attack. No public confirmation of the attack method, the exact date of intrusion, the volume of data taken, or any ransom demand has been provided in the available facts. The number of people affected is unknown. The organisation is identified as L'Ajuntament de Calvià, the local administration of the municipality of Calvià on the island of Mallorca, whose website offers access to services, news, and an electronic registry. Beyond the claim of internal-file exfiltration, further technical or operational details of the incident remain undisclosed.

Who is lockbit3?

LockBit3 is a well-documented ransomware operation that has appeared frequently in public reporting on cybercrime. The group is known for a double-extortion model: encrypting systems to disrupt operations while also copying data and threatening to publish it on a dedicated leak site if a ransom is not paid. Affiliates often gain initial access through phishing, compromised credentials, or unpatched remote services, then move laterally to locate and stage valuable files before deploying the ransomware. LockBit3 has been linked to numerous high-profile listings of private companies and public-sector bodies across multiple countries; its leak site is used to pressure victims by advertising stolen data. In this case the group claims that calvia.com was a victim and that internal files were taken; that claim has not been independently verified in the facts provided, and should be treated as an unverified assertion by the threat actor.

Who is calvia.com?

calvia.com is the public website of the Ajuntament de Calvià, the municipal government of Calvià in Mallorca, Spain. Local administrations of this kind manage day-to-day civic services: resident registration, urban planning, local taxes and fees, social services, public works, licensing, and electronic submission of documents through an online registry. They routinely hold or process personal data belonging to residents, property owners, employees, contractors, and people who interact with the council for permits, benefits, or complaints. A breach involving a municipal website is consequential because the organisation sits at the intersection of public service delivery and sensitive personal information; disruption or data loss can affect both the continuity of local government functions and the privacy of ordinary citizens who have no choice but to deal with their town hall.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or categories of personal information has been disclosed. Organisations such as a municipal council typically maintain records that can include names, addresses, national identification numbers, contact details, property and tax information, employment or contractor data, correspondence, and documents submitted through electronic registries. Whether any of those categories were among the files taken in this incident is unconfirmed. Readers should therefore treat the exact contents of the exfiltrated material as unknown rather than assume any specific data set was or was not involved.

The real-world impact

For individuals, the principal risks are those that follow any unauthorised access to government-held personal data: possible identity fraud, targeted phishing that references genuine local-government interactions, or misuse of contact and address information. Because the scale of the incident and the precise data types remain unknown, it is not possible to quantify how many people may be affected or how sensitive the material is. For the Ajuntament itself, a ransomware incident that includes data exfiltration can mean temporary disruption of online services, the cost of investigation and recovery, and the longer-term obligation to notify regulators and affected parties under applicable data-protection rules. Public trust in digital local-government channels can also be eroded when residents learn that internal files may have left the organisation's control. None of these outcomes has been confirmed as having occurred; they are the ordinary consequences that follow from the type of claim LockBit3 has made.

Were you affected?

If you live in or have dealt with the municipality of Calvià—through the electronic registry, tax payments, licensing, or other services—consider the listing a reason to remain alert rather than proof that your own data was taken. Practical first steps include monitoring bank and credit accounts for unusual activity, treating unexpected emails or messages that reference local-government matters with caution, and changing passwords on any accounts that reuse credentials you may have used with council services. Where available, enable multi-factor authentication. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Because the number of people affected and the exact files involved remain undisclosed, these measures are precautionary; they do not depend on confirmation that your information was among the material claimed by LockBit3.

AICompiled with AI assistance from public sources and published under our editorial standards.