erga.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 1 October 2023, the architectural and engineering firm erga.com appeared on a leak site operated by the LockBit3 ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical details of the incident have not been disclosed.

The listing matters because erga.com operates as an architecture consultancy with a base in Lebanon and branches in Saudi Arabia, Qatar and the United Arab Emirates. Organisations of this type routinely handle project documentation, client correspondence and internal business records; any confirmed exposure of such material can create lasting practical and privacy consequences for staff, clients and partners.

Inside the incident

According to the available record, erga.com was listed by the LockBit3 ransomware group on 1 October 2023. The group’s claim is that internal files were exfiltrated during a ransomware attack. No public confirmation has established the precise date of initial access, the intrusion method, the volume of data taken, or whether encryption was also deployed on the firm’s systems. The number of individuals whose information may be involved is listed as unknown.

Beyond the leak-site listing and the description of “internal files,” no further verified technical indicators, ransom demands, or recovery timelines have been released in the material provided. As with many ransomware claims, the listing itself constitutes an assertion by the threat actor rather than an independently audited confirmation of every detail.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has functioned as a ransomware-as-a-service model. Affiliates gain access to victim networks, exfiltrate data, and often encrypt systems before posting victims on a dedicated leak site if payment is not made. The group has historically used double-extortion tactics: threatening both operational disruption through encryption and public release of stolen data to increase pressure.

Public reporting over several years has associated LockBit variants with attacks across multiple sectors and regions. Typical observed behaviours include exploitation of exposed remote-access services, use of stolen credentials, lateral movement inside networks, and staged data theft prior to ransom notes. In this case, the sole specific claim tied to erga.com is the leak-site listing and the assertion that internal files were taken; no additional statements attributed to the group about this particular victim appear in the given facts.

About erga.com

erga.com is described as an architectural and engineering firm headquartered in Lebanon, with branches in Saudi Arabia, Qatar and the UAE. It provides architecture consultancy services. Firms in this sector commonly manage design drawings, project specifications, contracts, client communications, employee records and financial or administrative documents related to construction and engineering work across multiple jurisdictions.

A breach affecting such an organisation is consequential because the work product often contains commercially sensitive plans, personal data of employees and clients, and information about third-party contractors or public-sector projects. Cross-border operations can also mean that data subject to different national privacy and professional-confidentiality rules may be involved, amplifying the practical impact if material is exposed.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of file types, record counts, or specific categories such as names, contact details, financial data or project documents has been published in the available record. Exact contents therefore remain unconfirmed.

Architectural and engineering consultancies of this kind typically hold design files, correspondence, contracts, employee information and client project data. While those categories represent the ordinary holdings of such a firm, it is not established which of them, if any, were among the files the group claims to have taken. Readers should treat any assumption about particular data elements as speculative until official confirmation is provided.

What's at stake

For individuals whose information may have been present in internal files, risks include unwanted contact, phishing attempts that reference real projects or colleagues, and potential misuse of personal or professional details. Employees and contractors could face identity-related fraud or reputational exposure if personnel or payroll-related material was included. Clients and partners may encounter commercial harm if proprietary designs, bids or contractual terms surface.

For the organisation, stakes include operational disruption, possible regulatory or contractual obligations to notify affected parties, loss of client confidence, and the cost of investigation and remediation. Because the scale of the incident and the precise data involved are undisclosed, the full extent of these risks cannot yet be quantified from public information alone.

What to do if you're exposed

If you have a past or present relationship with erga.com—as an employee, client, contractor or partner—monitor accounts and communications for unusual activity. Prefer official channels when verifying any messages that claim to relate to the incident. Consider placing fraud alerts with relevant credit or identity services where available in your jurisdiction, and change passwords on any accounts that may have shared credentials or recovery details with workplace systems.

Retain copies of important correspondence and be cautious of follow-up phishing that references architecture projects or the breach itself. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach datasets, which provides an additional early-warning step while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.