eurosko.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 19 April 2024, the Scandinavian shoe retailer eurosko.com appeared on a leak site operated by the ransomware group known as lockbit3. The listing claims that internal files were taken during a ransomware attack. Public detail remains limited: the number of people affected is unknown, and the precise contents of the files have not been independently confirmed. For customers, staff and partners whose information may sit inside those systems, the practical stakes are straightforward — personal and commercial data can be misused for fraud, phishing or identity theft long after an incident is first reported.

This article sets out only what is known from the available record, places the claim in context, and outlines the real-world risks and basic steps people can take.

What happened

According to the reported record, eurosko.com was listed by the lockbit3 ransomware group on 19 April 2024. The group claims that internal files were exfiltrated in a ransomware attack. No further technical details — such as the initial access method, the duration of the intrusion, the volume of data taken, or whether systems were encrypted — have been disclosed in the public summary. The number of individuals potentially affected is listed as unknown. At the time of the listing, independent verification of the claim had not been published; the appearance of an organisation on a ransomware leak site is therefore treated here as an unverified assertion by the threat actor rather than confirmed fact.

Who is lockbit3?

Lockbit3 is a well-documented ransomware operation that has been active for several years under successive versions of the LockBit brand. Like many modern ransomware groups, it typically operates on a ransomware-as-a-service model: affiliates gain access to victim networks, deploy the encryptor, and share proceeds with the core developers. A central pressure tactic is the public leak site, where the group posts the names of organisations it claims to have compromised and, if a ransom is not paid, threatens to release stolen data. LockBit affiliates have historically targeted a wide range of sectors across multiple countries, often focusing on organisations that hold operational or customer data whose exposure would create business disruption or regulatory pressure. The group’s claims on its leak site are self-reported and should be treated as such until corroborated by the victim organisation, law enforcement or independent forensic reporting.

About eurosko.com

Eurosko is described in the available summary as the largest shoe chain in Scandinavia. It operates physical stores and an online presence under eurosko.com, aiming to serve customers — including families and children — with a broad product range and in-store expertise. As a multi-generation family retail business of this scale, it necessarily maintains systems that support inventory, point-of-sale, e-commerce, customer accounts, employee records and supplier relationships. A ransomware incident affecting such an organisation is consequential because retail chains sit at the intersection of consumer trust, payment processing and day-to-day operations; any disruption or data exposure can affect both the company’s ability to trade and the privacy of the people who shop or work there.

What data was at risk

The only data category named in the public record is “internal files exfiltrated in [a] ransomware attack.” No inventory of file types, databases or record counts has been released. Organisations of this kind typically hold customer contact and purchase information, loyalty or account credentials, employee personal data, payroll and HR files, supplier contracts, and internal operational documents. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the files the group claims to have taken. Readers should therefore treat any specific assertion about particular data elements as speculative until the company or an official investigation provides further detail.

The real-world impact

For individuals, the main risks associated with the possible exposure of internal retail files are secondary misuse: phishing emails that reference real purchases or account details, attempts to reset passwords using known email addresses, or fraud that exploits any payment or identity information that may have been present. Employees could face similar risks if HR or payroll data were included. For the organisation, consequences can include operational disruption, costs of investigation and recovery, regulatory notification duties under European data-protection rules, and longer-term damage to customer confidence. None of these outcomes is inevitable; their severity depends on what was actually taken and how quickly protective measures are applied. Public reporting has not yet quantified those factors for this incident.

Were you affected?

Because the number of people affected and the precise data sets remain unknown, it is not possible to say with certainty whether any given customer or employee is involved. Practical first steps are still useful:

• Monitor bank and card statements for unfamiliar charges and contact the issuer promptly if anything appears.
• Treat unsolicited emails, texts or calls that reference Eurosko or recent purchases with caution; verify through official channels rather than links in the message.
• Change passwords for any accounts that reuse credentials also used with the retailer, and enable multi-factor authentication where available.
• Consider placing fraud alerts with relevant credit-reference services if you believe sensitive personal data may have been exposed.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in other incidents.

Official updates, if any, will come from Eurosko or competent authorities. Until more confirmed detail is published, the safest approach is measured vigilance rather than assumption of either total safety or total compromise.

AICompiled with AI assistance from public sources and published under our editorial standards.