cangas.gal Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 16 June 2023, the domain cangas.gal, associated with the Cangas City Council, was listed by the ransomware group known as lockbit3. Public reporting states that internal files were exfiltrated in a ransomware attack. The group’s own leak-site notice claimed the material comprised “all main data of The Cangas City Council,” including documents, personal data, finance and accounting records, and police data. The number of people affected remains unknown, and independent confirmation of the full scope has not been published.

For residents, staff and anyone who has dealt with the council, the listing raises concrete questions about what information may now be in criminal hands and what practical steps can reduce further harm. Detail beyond the group’s claim and the basic fact of an exfiltration is limited.

Inside the incident

According to available records, cangas.gal was publicly listed by lockbit3 on 16 June 2023. The sole concrete description of the incident is that internal files were allegedly exfiltrated during a ransomware attack. No public source has disclosed the precise date the intrusion began, how the attackers gained access, whether encryption was also deployed, or whether any ransom demand was paid or refused. The volume of data taken and the exact file inventory have not been independently verified.

The group’s leak-site text asserted that the haul contained the council’s main data holdings—documents, personal data, finance and accounting material, and police data—and invited viewers to “enjoy” it. That wording is a claim made by the actors themselves; it has not been corroborated by the council or by forensic reporting released to the public. Until such confirmation appears, the incident is best understood as an asserted ransomware-related exfiltration whose full technical and organisational details remain undisclosed.

Inside lockbit3

Lockbit3 is the name used for a long-running ransomware operation that has repeatedly targeted organisations across many sectors and countries. Publicly documented behaviour of the group includes double-extortion tactics: encrypting systems while simultaneously copying data, then threatening to publish the stolen material on a dedicated leak site if payment is not made. Affiliates often gain initial access through phishing, exploited vulnerabilities or compromised remote-access credentials, after which they move laterally, escalate privileges and stage data for exfiltration before deploying the ransomware payload.

The group has maintained a Tor-based blog on which it names victims and, in many cases, posts sample files or larger archives. Listings are therefore marketing and pressure tools as much as factual disclosures; they should be treated as unverified claims unless the victim organisation or independent investigators confirm them. Lockbit3 has been linked to numerous high-profile incidents over several years, yet each new listing must still be assessed on the evidence available for that specific case. In the cangas.gal matter, the only public assertion is the group’s own notice; no further technical indicators or victim statements have been supplied in the records used here.

cangas.gal and its sector

Cangas.gal is the online presence of the Cangas City Council, a municipal authority in Spain. Local councils of this type routinely manage a wide range of civic functions: resident registration, tax and fee collection, urban planning, social services, local policing coordination, public procurement and internal administration. The data they hold therefore typically includes both ordinary administrative records and more sensitive categories—identity details, financial transactions, correspondence with citizens, and information generated by local police or security services.

A breach affecting a city council is consequential because the organisation sits at the intersection of public administration and daily citizen life. Compromised records can affect not only employees but also residents who have interacted with the council for permits, benefits, taxes or policing matters. Even when the precise contents of a leak remain unconfirmed, the mere possibility that municipal data has left official control creates lasting trust and privacy concerns for the community the council serves.

What was likely exposed

The facts state that internal files were exfiltrated and that lockbit3 claimed the material included documents, personal data, finance and accounting records, and police data. No independent inventory has been released, and the number of affected individuals is unknown. Organisations of this kind ordinarily hold the following categories of information; whether any or all of them were present in the stolen set remains unconfirmed:

• Civil-registry and identity-related records of residents and staff
• Financial, budgeting and accounting files
• Internal administrative documents and correspondence
• Local police or public-safety related data
• Procurement, contracts and vendor information

Readers should treat the group’s descriptive list as an unverified claim rather than established fact. Exact file names, record counts and the presence or absence of any particular data element have not been publicly verified.

The real-world impact

If the claimed material is authentic, individuals whose personal or financial details appear in council systems could face risks of identity misuse, targeted phishing, or unwanted contact. Finance and accounting records may expose payment details, vendor relationships or internal budget figures that could be exploited for fraud. Police-related data, even if limited, can contain sensitive operational or personal information whose exposure may endanger privacy or, in some cases, personal safety.

For the council itself, the incident carries operational, legal and reputational consequences. Restoring systems, investigating the intrusion, notifying regulators and supporting affected residents all require time and resources. Public confidence in the handling of municipal data can be damaged even when the full technical picture remains incomplete. Because the scale of the exfiltration and the precise data types have not been independently confirmed, the actual harm may be smaller or larger than the group’s notice suggests; the uncertainty itself is part of the impact.

What to do if you're exposed

Anyone who has had dealings with the Cangas City Council—residents, employees, contractors or correspondents—should assume their information might be involved until clearer inventories appear. Practical first steps include monitoring bank and credit statements for unfamiliar activity, treating unexpected emails or calls that reference council business with caution, and changing passwords on accounts that may have shared credentials or recovery details with municipal services. If you receive notification from the council or from Spanish data-protection authorities, follow the instructions they provide. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which offers a quick additional signal of whether your details are circulating.

Remain alert for follow-up communications from official sources. Public detail on this incident is still limited; further verified information, if released, will give a clearer picture of who needs to take additional protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.