excon.cl Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 October 2023, the Chilean construction firm known as excon.cl appeared on a listing associated with the lockbit3 ransomware group. Public detail is limited: the number of people affected remains unknown, and the material described is internal files said to have been taken in a ransomware attack. For employees, contractors, partners and others whose information may sit inside those files, the practical question is straightforward—what was exposed, who might use it, and what can be done now.

Ransomware listings of this kind are claims by the actors involved until independently verified. Even so, the appearance of a company that works on earthmoving, construction and mining projects raises concrete concerns about operational records, commercial data and any personal details held in the ordinary course of business.

Inside the incident

According to the available record, excon.cl was listed by the lockbit3 ransomware group on 24 October 2023. The reported description states that internal files were exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been published. Timing of the intrusion itself, the precise method of initial access, the volume of data taken, and any ransom demand or negotiation details are undisclosed in the public summary.

What is known is therefore narrow: a claim on a lockbit3-associated listing, a date of reporting, and a characterisation of the material as internal files removed during a ransomware incident. No further technical indicators, file inventories or confirmation of data publication have been supplied in the facts at hand. Readers should treat the listing as an unverified claim by the group rather than as independently established fact.

The group behind it: lockbit3

lockbit3 is a well-documented ransomware operation that has been active for years under the broader LockBit banner. The group is known for a ransomware-as-a-service model in which affiliates conduct intrusions and deploy the encryptor, while the core operation maintains leak sites and pressure tactics. Typical activity includes double extortion: data is copied before systems are encrypted, and the threat of public release is used to increase leverage.

Public reporting on lockbit3 and its predecessors has described large numbers of claimed victims across many countries and sectors, frequent use of stolen credentials or exploited vulnerabilities for entry, and the publication of sample files or full archives when negotiations stall. None of that general pattern proves the specifics of any single case. In this instance, the only attribution present is the group’s own listing of excon.cl; no additional statements by lockbit3 about this victim beyond that listing are contained in the available facts, and the claim should be read as such.

About excon.cl

excon.cl corresponds to Constructora Excon S.A., described in the reported summary as a leading firm in earthmoving works with an extensive track record in construction projects and mining-related processes. The organisation presents itself as staffed by a highly qualified and committed team. Companies of this type typically manage project documentation, equipment and site logistics, contracts with clients and subcontractors, and the administrative records that accompany large-scale civil and mining work.

A breach affecting such an organisation is consequential because construction and mining operations sit at the intersection of commercial confidentiality, worker and contractor information, and sometimes regulated or safety-critical project data. Disruption or exposure can affect bidding positions, ongoing site coordination, and the privacy of people whose details appear in payroll, access, or vendor systems. The public record does not state that any particular category of harm has already materialised; it simply places the firm on a ransomware group’s list.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of file types, no count of records, and no confirmation of personal versus purely commercial content have been disclosed. Exact contents therefore remain unconfirmed.

Organisations engaged in earthmoving, construction and mining commonly hold project plans, contracts, financial and procurement records, correspondence, and administrative data that may include names, contact details, identification numbers or employment-related information for staff and contractors. They may also retain vendor and client information. Whether any of those categories were present in the files claimed by lockbit3 is not established by the public summary. It is accurate only to say that internal files are alleged to have been taken and that the precise composition is unknown.

What's at stake

For individuals, the real-world risks centre on the possible misuse of any personal or contact data that may have been inside internal systems—phishing that references genuine projects or colleagues, attempts at identity fraud, or unwanted contact. Without a confirmed data inventory, those risks cannot be quantified, yet they are the ordinary consequences when corporate files leave an organisation’s control.

For the organisation, stakes include operational disruption if systems were encrypted, potential exposure of commercial terms or project details to competitors or opportunistic actors, regulatory or contractual notification duties depending on Chilean and sector rules, and the longer task of verifying what left the network. Reputation and trust with clients and partners can also be affected when a ransomware listing becomes public, regardless of whether full data dumps later appear. None of these outcomes is asserted here as having already occurred; they are the concrete possibilities that follow from the type of incident claimed.

If your data was in this claimed breach

If you have worked with, contracted for, or otherwise shared information with Constructora Excon S.A. or excon.cl, treat the situation as a prompt for ordinary hygiene rather than panic. Change passwords on related accounts, enable multi-factor authentication where available, and watch for unexpected messages that reference the company, specific projects or personal details. Be cautious about opening attachments or following links in unsolicited mail. If you believe sensitive identity documents or financial data may have been involved, consider monitoring bank and credit activity and following local guidance on fraud alerts.

Because the scale and exact contents remain undisclosed, there is no public list of affected individuals to consult. You can run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it can show whether the same address appears elsewhere and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.