customssupport.be Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target specialised service firms that sit at the centre of cross-border trade, where operational data and client records form the backbone of daily work. In this environment, the appearance of a company name on a criminal leak site is often the first public signal that an organisation may have suffered a serious intrusion. On 12 July 2024, the Belgian firm customssupport.be was listed by the LockBit3 ransomware group, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and public detail about the precise scope of the incident is limited.

For clients, partners and employees who rely on customs consultancy services, such a listing raises immediate questions about what information may have left the organisation’s control and what practical steps they should take. This article sets out only what is known from the available record, places the claim in the context of LockBit3’s established methods, and explains the real-world implications without speculation.

What happened

According to the public record, customssupport.be was listed by the LockBit3 ransomware group on 12 July 2024. The group’s claim states that internal files were exfiltrated in a ransomware attack. No further Reported Details have been released about the date the intrusion began, the method of initial access, the volume of data taken, or whether systems were encrypted in addition to the alleged theft. The number of individuals whose information may have been involved is listed as unknown. Because the listing originates from the threat actor’s own site, it constitutes an unverified claim rather than an independently confirmed breach report. Public detail on timing, scale and technical method therefore remains limited.

Inside lockbit3

LockBit3 is a well-documented ransomware-as-a-service operation that has been active for several years and is known for a double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it if a ransom is not paid. The group typically advertises victims on a dedicated leak site, often releasing sample files or larger archives to pressure organisations. Its affiliates have targeted a wide range of sectors, including professional services, logistics and manufacturing, and have historically used phishing, exploited vulnerabilities and compromised remote-access tools as common entry points. LockBit3 has also been noted for rapid public naming of victims and for offering a “name-and-shame” approach when negotiations stall. None of these general patterns confirm the specific technical details of the customssupport.be incident; they simply describe the actor’s established public behaviour. In this case, the group claims that internal files belonging to customssupport.be were exfiltrated, but independent verification of that claim has not been provided in the available facts.

Who is customssupport.be?

customssupport.be is a Belgian organisation that specialises in import, export and transit services, goods classification and customs consultancy. Firms of this type act as intermediaries between businesses and customs authorities, helping clients navigate tariff codes, documentation requirements, transit procedures and regulatory compliance. They routinely handle commercial invoices, shipping records, product classifications, client contact details and correspondence with government agencies. Because customs processes sit at the intersection of international trade and regulatory oversight, the data such firms hold can include commercially sensitive information about supply chains, pricing and product origins. A breach affecting a customs consultancy is therefore consequential not only for the firm itself but also for the importers, exporters and logistics partners who entrust it with operational records. The organisation’s public description of its services aligns with this sector profile; no additional internal details about its size, client base or security posture have been disclosed in connection with the LockBit3 listing.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory of file types, databases or personal data categories has been published. Organisations that provide customs consultancy typically maintain records such as client company details, shipment documentation, goods classifications, correspondence with customs authorities and internal operational notes. Whether any of those categories were among the files claimed by LockBit3 is unconfirmed. The number of people affected is listed as unknown, so it is not possible to state whether personal data of individuals, corporate data only, or a mixture of both left the organisation’s systems. Readers should treat any assertion about specific data elements as speculative until official confirmation is available.

What's at stake

For individuals and companies that have worked with customssupport.be, the primary risk is that internal files containing commercial or personal information could be published, sold or used for further fraud. Exposed shipment records or classification data might reveal business relationships, pricing structures or product details that competitors or fraudsters could exploit. If personal contact information or identity documents were among the files, those details could be used in targeted phishing or social-engineering attempts. For the organisation itself, the consequences include potential regulatory scrutiny under data-protection rules, disruption of client trust, and the operational cost of investigating and containing the incident. Because the exact contents remain unconfirmed, the severity of these risks cannot yet be quantified; the prudent course is to assume that any sensitive material held by the firm could be involved until proven otherwise. The listing by LockBit3 also places the firm under public pressure, which can affect ongoing negotiations and reputation even before any data is released.

Were you affected?

If you have used the services of customssupport.be, or if your company has shared documentation with the firm, treat the LockBit3 claim as a reason to increase vigilance rather than as proof that your specific data has been published. Monitor bank and credit accounts for unusual activity, be alert to unexpected emails or calls that reference customs or shipping matters, and consider changing passwords on any accounts that may have been linked to the firm. Keep copies of important correspondence in case you later need to demonstrate what information was shared. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official updates from the organisation or from Belgian data-protection authorities, if and when they appear, should be treated as the authoritative source of further detail. Until more confirmed information is released, the safest stance is cautious monitoring rather than panic.

AICompiled with AI assistance from public sources and published under our editorial standards.