egas.no Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by stealing internal data and threatening to publish it, a pattern that has become a routine feature of the cyber-threat landscape. Listings on criminal leak sites are now a common first public signal that an intrusion may have occurred, even when independent confirmation remains limited.

On 1 March 2023, the Norwegian organisation egas.no appeared on the leak site operated by the LockBit3 ransomware group. The group claims to have stolen internal data. The number of people affected is unknown, and public detail beyond the listing itself is limited. For anyone who has dealt with the organisation, the claim raises practical questions about what may have been taken and what steps are worth taking.

What happened

According to available reporting, egas.no was listed on the LockBit3 ransomware leak site on or around 1 March 2023. The group claims to have exfiltrated internal files in a ransomware attack. No further verified particulars—such as the precise date of intrusion, the technical method used, the volume of data taken, or whether any ransom was demanded or paid—have been disclosed in the public record. The number of individuals potentially affected remains unknown. The listing itself constitutes a claim by the threat actor rather than an independently confirmed breach report.

Who is lockbit3?

LockBit3 is a well-documented ransomware operation that has functioned as a ransomware-as-a-service platform. Affiliates gain access to victim networks, deploy encryption malware, and frequently exfiltrate data beforehand so the group can threaten public release if payment is not made. The group maintains a dark-web leak site where it names organisations and, in many cases, posts samples or larger archives of stolen material. LockBit variants have been observed across numerous sectors and countries for several years; the “3” designation refers to an evolved iteration of the group’s toolkit and branding. Public reporting on LockBit3 consistently describes double-extortion tactics—encryption plus data theft—as standard practice. No specific statements by the group about egas.no beyond the leak-site listing itself are part of the What's Publicly Reported of this incident.

Who is egas.no?

egas.no is an organisation operating under a Norwegian domain. Entities of this type typically handle internal business records, correspondence, operational documents, and data relating to customers, partners or employees. In Norway and comparable jurisdictions, such organisations often process personal information subject to data-protection rules, including contact details, contractual records and, depending on the nature of the business, more sensitive identifiers. A ransomware claim against any organisation that holds internal files is consequential because those files can contain both proprietary information and personal data whose exposure can create lasting risk for the people named in them. Public detail on the exact scope of egas.no’s activities and data holdings in connection with this incident is limited.

What was likely exposed

The facts state that internal files were claimed to have been exfiltrated in a ransomware attack. No itemised inventory of the stolen material has been made public, and the precise data types beyond the general description “internal files” remain undisclosed. Organisations of this kind commonly hold employee records, customer or supplier contact information, contracts, financial documents, internal communications and operational data. Whether any of those categories were present in the material LockBit3 claims to possess has not been independently confirmed. Until more detail emerges, the exact contents must be treated as unconfirmed.

Why it matters

When internal files are taken, the practical risks fall on both the organisation and any individuals whose information appears in those files. People may face phishing or social-engineering attempts that reference real details drawn from the stolen material. Credentials or personal identifiers, if present, can be reused in other fraud. The organisation itself may confront operational disruption, regulatory notification duties, and the longer-term task of determining what was actually removed. Because the number of people affected is unknown and the full contents of the claimed haul are undisclosed, the scale of individual harm cannot yet be measured; the prudent assumption is that anyone who has had a meaningful relationship with egas.no could be implicated until clearer information appears.

What to do if you're exposed

If you believe your data may have been involved, a small number of concrete steps reduce immediate risk:

• Treat unexpected messages that reference egas.no or personal details with caution; verify any request through a separate, trusted channel before responding or clicking links.
• Change passwords for accounts that may have shared credentials or recovery information with the organisation, and enable multi-factor authentication where it is available.
• Monitor financial and account statements for unfamiliar activity and consider placing fraud alerts if sensitive identifiers were likely held.
• Retain any official notices you receive from the organisation so you have a clear record of what it later confirms.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Public information on this incident remains limited to the LockBit3 listing and the claim of stolen internal files. Further clarity, if it comes, will most likely arrive through official statements from the organisation or independent verification. Until then, measured personal precautions are the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.