creatz3d.sg Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations of every size by pairing system encryption with the threat of public data leaks. Listings on criminal leak sites have become a routine feature of that landscape, often appearing before full details are known and leaving customers, partners and staff to weigh incomplete information.

On 11 November 2023, the Singapore-based firm creatz3d.sg was listed by the LockBit3 ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and wider technical detail has not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope is not part of the available record.

Inside the incident

According to the reported record, creatz3d.sg appeared on a LockBit3-associated leak site on 11 November 2023. The description characterises the event as a ransomware attack in which internal files were taken. No public figure has been given for the volume of data, the duration of any intrusion, the initial access method, or whether systems were encrypted in addition to the claimed exfiltration. The count of affected individuals is listed as unknown. Beyond the group’s listing and the high-level description of internal-file theft, further operational detail has not been made available in the material at hand.

Because the primary public signal is the leak-site claim, the incident should be treated as an asserted compromise rather than a fully documented forensic account. Organisations named in this way sometimes later confirm, dispute, or clarify the claims; no such clarification is included in the facts provided here.

Who is lockbit3?

LockBit3 is a well-documented ransomware operation that has appeared repeatedly in public reporting since earlier LockBit variants. Like many ransomware-as-a-service crews, it is associated with double-extortion tactics: encrypting victim systems while also copying data and threatening to publish it if a ransom is not paid. Affiliates typically gain access through common enterprise weaknesses—stolen credentials, exposed remote services, or unpatched software—then move laterally, stage data, and deploy the ransomware payload.

The group has maintained leak sites and negotiation channels used to pressure victims and, when payment is refused or talks fail, to post samples or larger data sets. Public tracking of LockBit activity has covered a wide range of sectors and countries. None of that general history, however, supplies verified specifics about the creatz3d.sg matter beyond the group’s own listing and the reported claim of internal-file exfiltration. Statements that appear on such sites remain claims until corroborated.

creatz3d.sg and its sector

Creatz3D is described in available summary material as a Singapore supplier of 3D printers that also offers 3D printing services. Firms in this niche sit at the intersection of hardware distribution, technical services, and often small-to-medium business and industrial customers who need additive-manufacturing equipment, consumables, or job-shop printing.

Companies of this type commonly hold customer and supplier contact records, order and invoice history, service tickets, shipping details, warranty information, and internal operational documents. Some also store design files, configuration data, or correspondence that relates to client projects. A breach affecting such an organisation matters because those records can identify individuals and businesses, reveal commercial relationships, and, depending on content, expose technical or financial particulars that were never intended for public release. The consequences extend beyond the firm itself to anyone whose details sat in its systems.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No inventory of file types, no record counts, and no confirmation of specific personal-data categories have been supplied. Exact contents therefore remain unconfirmed.

Organisations in retail and technical-services roles for 3D-printing equipment typically maintain, among other things:

• Customer and prospect contact details and order histories
• Supplier and partner records
• Invoices, quotes, and payment-related correspondence
• Service, support, and warranty documentation
• Internal administrative files, policies, and operational notes

Any of the above could fall under a broad label such as “internal files,” but that is an inference about what such businesses hold, not a statement of what was taken in this case. Without a disclosed data inventory, affected parties cannot assume a precise list.

The real-world impact

For individuals and businesses that dealt with creatz3d.sg, the practical risks centre on misuse of contact and commercial information. Email addresses and phone numbers can be used in targeted phishing that references real orders or service interactions. Invoice or contract details can lend credibility to fraud attempts. If design-related or project files were among the internal material, there could be confidentiality concerns for clients, though no such files have been specifically identified in the public facts.

For the organisation, a ransomware event that includes claimed exfiltration raises operational, legal, and reputational issues: possible disruption if systems were encrypted, the need to investigate and contain, notification duties where personal data is involved under applicable law, and the longer task of rebuilding trust with customers and partners. Because the number of people affected is unknown and the file-level detail is undisclosed, the outer bound of harm cannot be stated with precision from the current record.

What to do if you're exposed

If you have been a customer, supplier, or partner of creatz3d.sg, treat the situation as a prompt to tighten routine defences rather than as proof that any particular record of yours was taken. Change passwords on related accounts, especially if you reused credentials. Enable multi-factor authentication wherever it is offered. Watch for phishing or invoice-fraud messages that mention 3D printing, orders, or service work, and verify unexpected requests through a separate known channel. Review bank and card statements for unfamiliar charges if you previously paid the firm electronically. Keep copies of important correspondence in case you need to dispute a fraudulent transaction later.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check will not confirm or deny involvement in this specific incident, but it can show whether your address is circulating more widely and help you prioritise further password and account hygiene.

AICompiled with AI assistance from public sources and published under our editorial standards.