competenz.co.nz Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations that hold large volumes of personal and commercial records, listing victims on public leak sites as leverage. In this climate, even a single listing can signal that internal material has left an organisation’s control and may later appear in criminal markets or further attacks.

On 24 June 2024, the New Zealand industry-training body competenz.co.nz appeared on a leak site operated by the ransomware group known as lockbit3. The group claims to have stolen confidential internal files. The number of people affected remains unknown, and independent confirmation of the full scope has not been published.

What happened

Public reporting states that competenz.co.nz was listed by lockbit3 on 24 June 2024. According to the group’s own description, the organisation arranges training for apprenticeships and traineeships through on-the-job qualifications and supports employers, job seekers and people already in work across its industries. The group further claims it “have stolen a lot of confidential data,” specifically mentioning “ton of passports, finance, banking da…” The listing characterises the incident as a ransomware attack in which internal files were exfiltrated. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the available record. The number of individuals whose information may be involved is listed as unknown.

The group behind it: lockbit3

Lockbit3 is a well-documented ransomware operation that has operated for several years under the broader LockBit brand. Like many contemporary ransomware groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a public leak site where it posts victim names, sample files and countdown timers. It has previously claimed responsibility for attacks against organisations in multiple countries and sectors, often advertising the theft of personal documents, financial records and internal correspondence. Claims made on such sites are assertions by the attackers themselves; they are not independent verification. In this case the only public statement about the competenz.co.nz material is the group’s own listing and the partial description of stolen data it chose to publish.

competenz.co.nz and its sector

Competenz is a New Zealand industry training organisation that facilitates apprenticeships and traineeships. It works with employers, job seekers and existing workers to deliver on-the-job qualifications across a range of industries. Organisations of this type routinely hold identity documents, contact details, employment and training records, financial and banking information related to funding or payroll, and correspondence with both individuals and businesses. Because the data often spans young people entering the workforce, established employees and commercial partners, a breach can affect a wide cross-section of the community. The appearance of such an organisation on a ransomware leak site therefore raises concerns that personal and commercial records may have left authorised control.

What was likely exposed

The only data types named in the public record are “internal files” said to have been exfiltrated in a ransomware attack. The group’s own text asserts the theft of “a lot of confidential data” and specifically references passports together with finance and banking material (the published fragment ends mid-phrase). Exact file counts, complete data categories and confirmation that every claimed item was in fact taken remain undisclosed. Organisations that manage apprenticeships and industry training typically retain passport or other identity scans for verification, banking details for payments or reimbursements, employment contracts, training progress records and internal financial documents. Whether any or all of those categories were among the files the group claims to hold has not been independently verified.

What's at stake

If the claimed material is authentic and later circulated, individuals could face identity-theft risks arising from passport data, financial fraud from banking details, and unwanted contact or social-engineering attempts based on employment or training records. Employers and partner organisations whose information appears in the same files may encounter commercial or contractual exposure. For competenz.co.nz itself, the incident creates operational, reputational and regulatory considerations common to any organisation whose internal files are asserted to have been stolen. Because the number of people affected is unknown and the precise contents unconfirmed, the full scale of these risks cannot yet be quantified from public sources.

What to do if you're exposed

Anyone who has dealt with competenz.co.nz—apprentices, trainees, employers or staff—should treat the listing as a prompt to review their own exposure. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on important accounts, and be alert to phishing messages that reference training or employment details. If you supplied identity documents, consider contacting the relevant passport or identity authority for advice on protective measures. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check does not confirm involvement in this specific incident but can indicate whether personal information is circulating more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.