cometgroup.be Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations that combine encryption with the threat of data leaks have become a persistent feature of the threat landscape in recent years. On 10 September 2021, the Belgian organisation cometgroup.be appeared on a leak site associated with the LockBit group, an event that illustrates how such listings can surface even when details about the underlying incident remain limited.

The listing indicates that internal files were claimed to have been taken during a ransomware attack. No information has been made public about the number of individuals affected, the volume of data involved, or the precise method of intrusion.

What happened

On 10 September 2021, cometgroup.be was listed on the leak site maintained by the LockBit ransomware group. The group claims to have stolen internal data from the organisation. No further details about the timing of the intrusion, the scale of the operation, or the technical methods used have been disclosed publicly. The number of people potentially affected is also unknown.

Inside lockbit2

LockBit operates as a ransomware-as-a-service model in which affiliates deploy the malware and share proceeds with the operators. Public reporting has documented the group’s use of double-extortion tactics, in which data is both encrypted on victim systems and threatened with public release if ransom demands are not met. The group has been linked to incidents across multiple sectors and geographies since at least 2019, with its leak sites serving as a visible component of its operations. In this case, the listing of cometgroup.be constitutes the group’s claim; independent confirmation of the data theft has not been reported.

Who is cometgroup.be?

cometgroup.be is a Belgian organisation whose name indicates a corporate group structure. Entities of this type commonly maintain records related to operations, personnel, suppliers and clients. A breach involving internal files at such an organisation can be consequential because the data may include information that supports business continuity or regulatory compliance, even when the precise contents remain undisclosed.

What was likely exposed

The only detail provided is that internal files were allegedly exfiltrated. The exact categories of data contained in those files have not been disclosed. Organisations of this kind routinely hold employee records, contractual documents, financial information and operational correspondence; however, whether any of these specific categories were present in the claimed exfiltration cannot be confirmed from available information.

What's at stake

For individuals whose information may have been among the internal files, the primary concerns are potential misuse of personal or financial details and the possibility of follow-on fraud. For the organisation, the incident introduces risks of reputational impact, regulatory scrutiny and disruption to business processes while remediation takes place. Because the scope of the data remains unknown, the full extent of these risks cannot yet be quantified.

What to do if you're exposed

Individuals who believe their information may be involved should monitor their financial accounts and official correspondence for unusual activity. Changing passwords for any associated online services and enabling multi-factor authentication where available are standard first steps. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.