crossinggroup.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that builds and maintains critical underground infrastructure appears on a ransomware group's leak site, the practical concern is straightforward: internal files may have left the organisation's control, and people connected to that business — employees, contractors, partners, clients — cannot yet know whether their information was among them. Public reporting does not say how many people are affected or exactly what records were taken.

On 19 April 2023, crossinggroup.com was listed by the group known as lockbit3. The listing is a claim by that group that it conducted a ransomware attack and exfiltrated internal files. Independent confirmation of the full scope has not been set out in the available record, so the stakes for individuals remain real but still incompletely defined.

Inside the incident

According to the public breach record, crossinggroup.com was listed by lockbit3 on 19 April 2023. The record states that internal files were exfiltrated in a ransomware attack. It does not disclose the number of people affected, the precise date the intrusion began, the technical method of entry, or whether encryption of systems occurred alongside theft of data.

No file counts, sample documents, ransom demand figures, or negotiated outcomes appear in the provided facts. The incident is therefore known primarily through the group's leak-site listing and the characterisation that internal files were taken. Anything beyond that — timelines inside the network, which systems were reached, or whether data was later published in full — remains undisclosed in the material at hand.

Who is lockbit3?

LockBit 3 (also referred to as LockBit Black in public reporting) is a well-documented ransomware operation that has appeared frequently in threat-intelligence reporting since the earlier LockBit iterations. Groups operating under this name typically run a ransomware-as-a-service model: affiliates gain access to victim networks, deploy encryptors, and exfiltrate data before or during encryption, then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid.

Publicly observed tactics associated with the brand include double extortion (theft plus encryption), pressure campaigns timed around leak-site countdowns, and the use of stolen credentials, exposed remote services, or other common initial-access paths. The group has claimed responsibility for numerous incidents across sectors and geographies. In this case, the only specific assertion tied to crossinggroup.com is the listing itself and the claim that internal files were exfiltrated; no further statements by the group about this victim are included in the facts, and the listing should be treated as an unverified claim unless separately confirmed.

Who is crossinggroup.com?

The Crossing Group describes itself as one of the largest trenchless construction companies in North America, providing integrated services to the energy, municipal, civil, and utility sectors. Trenchless construction involves specialised methods for installing or rehabilitating underground pipes and conduits with minimal surface disruption — work that supports pipelines, water and sewer systems, and related infrastructure.

Organisations of this type routinely hold project documentation, engineering drawings, contracts, vendor and subcontractor details, employee records, and communications with public- and private-sector clients. Because the work often touches regulated energy and municipal infrastructure, a breach can affect not only the company but also counterparties who share sensitive operational or commercial information. The consequential nature of an incident here stems from that role: disruption or exposure can reach beyond a single corporate network into the supply chains and public works that depend on the firm's services.

What was likely exposed

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. Exact contents, volumes, and data categories are not itemised in the public record. For a trenchless construction firm serving energy, municipal, civil, and utility clients, internal files commonly include materials such as those listed below; whether any of these were in fact taken remains unconfirmed.

• Project plans, engineering drawings, and technical specifications
• Contracts, invoices, and commercial correspondence with clients and subcontractors
• Employee or contractor personnel and contact information
• Operational schedules, site data, and vendor records
• Internal email and administrative documents

No statement in the available facts confirms that customer personal data, payment card details, or any other specific category was included. Readers should treat the precise inventory as unknown until the organisation or a verified investigation provides more detail.

Why it matters

For individuals, the main risks are secondary misuse of any personal or contact data that may have been present in internal files — phishing that references real projects or colleagues, credential stuffing if work email addresses and related passwords were stored, or social engineering aimed at employees and partners. Because the headcount of affected people is unknown, it is not possible to say how widely those risks extend.

For the organisation, exposure of internal files can mean competitive harm if bidding or pricing material surfaces, contractual friction with clients who shared confidential project information, and operational cost in investigation, notification, and hardening. Infrastructure-related firms also face heightened scrutiny when operational details leave controlled environments, even when no industrial-control systems are known to have been involved. None of this establishes negligence; it simply describes the ordinary consequences that follow when internal material is claimed to have been stolen.

Were you affected?

If you work for, contract with, or have been a client of The Crossing Group or crossinggroup.com, treat the incident as a prompt to review your own exposure rather than as proof that your data was taken. Practical first steps include monitoring work and personal email for targeted phishing that references the company or specific projects, changing passwords that may have been reused on work-related accounts, and enabling multi-factor authentication where it is available. Watch financial and credit activity only if you have reason to believe identity documents or financial details were shared with the firm; the public record does not confirm such data was involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not prove or disprove involvement in this specific incident, but it can show whether your address is circulating more broadly and help you prioritise further precautions while official detail remains limited.

AICompiled with AI assistance from public sources and published under our editorial standards.