dgi.gouv.ml Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 15, 2022, the domain dgi.gouv.ml was listed on a leak site operated by the lockbit2 ransomware group. The entry states that internal files were exfiltrated during a ransomware attack, though the number of people affected and the precise contents of any data remain undisclosed. The incident is known only through the group’s public listing. No independent confirmation of the claimed data theft or details on the attack method have been released.

What happened

The organization dgi.gouv.ml was added to the lockbit2 ransomware leak site on June 15, 2022. The group claims to have stolen internal files during a ransomware operation. No information has been made public about the timing of the intrusion itself, the volume of data involved, or whether any ransom demand was issued or met.

Who is lockbit2?

Lockbit2 is a ransomware group that has conducted operations since at least 2019. It follows a double-extortion model in which data is encrypted on victim systems and copies are also taken, with threats to publish the stolen material if payment is not received. The group has targeted organizations across multiple sectors and countries, often using affiliate operators who deploy its ransomware tools. Its leak sites serve as a public platform to pressure victims by listing claimed breaches.

About dgi.gouv.ml

Dgi.gouv.ml is the online presence of Mali’s Direction Générale des Impôts, the government agency responsible for tax administration. Such agencies collect and store records related to individual and corporate taxpayers, including identification details, income information, and payment histories. A breach at a tax authority can therefore involve data that is both sensitive and difficult to change.

What was likely exposed

The only detail provided is that internal files were allegedly exfiltrated. The exact categories of data are not disclosed. Tax authorities routinely hold personal identifiers, financial declarations, bank references, and correspondence with taxpayers; however, whether any of these specific records were among the claimed files cannot be confirmed from available information.

Why it matters

Tax records contain information that can be used for identity verification and financial transactions. If the claimed files include such material, affected individuals could face risks of fraud or misuse over an extended period. For the agency, the incident raises questions about the security of systems that process mandatory citizen data, though the operational impact has not been publicly detailed.

If your data was in this claimed breach

Monitor bank and tax accounts for unusual activity and consider placing fraud alerts with relevant financial institutions. Review any official correspondence from Malian tax authorities for notices about the incident. Individuals can also run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.