gdz.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target software providers that sit at the centre of global logistics, knowing that disruption or data theft can ripple outward to carriers, agents and their customers. In early March 2023 one such listing appeared on a LockBit3 leak site, naming the shipping-line platform gdz.com.

Public detail remains limited: the number of people affected is unknown, and the precise contents of the material the group claims to hold have not been independently confirmed. What is known is that LockBit3 asserted it had exfiltrated internal files and that the intrusion extended to the company’s customers. For organisations and individuals whose operations or personal data may touch this platform, the listing is a concrete reason to review exposure and harden defences.

What happened

On 7 March 2023 the ransomware group LockBit3 listed gdz.com on its leak site. According to the group’s own statement, the attack involved the exfiltration of internal files. The listing further claimed that the intrusion was not confined to gdz.com itself: “As a result of the attack on this company, we also attacked its customers.” No independent confirmation of the volume of data taken, the exact date of initial access, or the technical method used has been published in the available record. The number of individuals affected remains unknown.

The group’s description of the victim characterises gdz.com as a fully integrated shipping-line software provider that supplies a complete platform for managing the commercial and operational aspects of ocean carriers and agents. Beyond that characterisation and the claim of customer impact, further operational detail about the incident itself has not been disclosed.

The group behind it: lockbit3

LockBit3 is a well-documented ransomware-as-a-service operation that has been active for several years. It typically gains initial access through phishing, exploited vulnerabilities or compromised credentials, then moves laterally, exfiltrates data and encrypts systems before posting victims on a dedicated leak site if a ransom is not paid. The group is known for high-volume campaigns against organisations across many sectors, including logistics, manufacturing and professional services, and for publicly shaming victims by releasing sample files or full archives when negotiations stall.

In this case the sole public claim is the leak-site listing itself. No additional statements, screenshots or file samples specific to gdz.com beyond the brief description already noted have been verified in the available facts. As with other LockBit3 postings, the listing should be treated as an unverified assertion by the threat actor until corroborated by the victim or by independent forensic reporting.

Who is gdz.com?

gdz.com operates in the maritime logistics software sector. Platforms of this type are used by ocean carriers and their agents to handle commercial contracts, vessel schedules, cargo bookings, documentation and day-to-day operational coordination. Because such systems sit at the intersection of multiple shipping companies, freight forwarders and port agents, they routinely process both corporate operational data and personal information belonging to employees, crew and commercial contacts.

A breach at a central software provider is consequential precisely because of that hub position. Disruption or data exposure can affect not only the software company but also the carriers and agents that rely on it, amplifying the potential reach of any stolen material. Public information does not indicate whether gdz.com has issued its own statement confirming or denying the LockBit3 claims.

The information in question

The only data type explicitly named in the available record is “internal files exfiltrated in ransomware attack.” No inventory of file categories, no count of records and no confirmation of whether customer databases, credentials, financial documents or personal data were included has been published. The group’s claim that customers were also attacked suggests that material belonging to third parties may have been involved, yet the precise nature of that material remains undisclosed.

Organisations that supply shipping-line management platforms typically hold commercial contracts, voyage and cargo data, user account information, internal correspondence and, in many cases, personal details of staff and business contacts. Whether any of those categories were among the files LockBit3 claims to possess cannot be established from the public facts. Readers should therefore treat the exact contents as unconfirmed.

What's at stake

For individuals whose data may have been present in the environment, the practical risks include targeted phishing, identity misuse or social-engineering attempts that leverage any exposed personal or professional details. Because the scale of the incident is unknown, it is impossible to quantify how many people face that exposure.

For gdz.com and its customers the stakes are operational and reputational. Ocean carriers and agents depend on continuous access to scheduling, booking and documentation systems; any residual access by attackers or any subsequent leak of commercial information could disrupt sailings, expose competitive data or trigger contractual and regulatory obligations. Even if systems have been restored, the possibility that internal files remain in criminal hands creates an ongoing need for monitoring and customer notification where required by law.

Were you affected?

If you have an account with gdz.com or work for an ocean carrier or agency that uses its platform, treat the LockBit3 claim as a prompt to act. Change passwords on any related accounts, enable multi-factor authentication where available, and watch for unexpected messages that reference shipping or logistics details. Monitor financial and credit activity for unusual behaviour. Organisations should review access logs, rotate credentials, and follow their incident-response and notification procedures.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your wider exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.