gerb.bg Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In early August 2023, the Bulgarian political organisation behind gerb.bg appeared on a ransomware group’s leak site, raising immediate practical questions for anyone whose personal or organisational details might sit in its systems. When a political party’s internal files are claimed to have been taken, the stakes are concrete: contact details, internal correspondence, membership or supporter records, and administrative documents can all become tools for fraud, targeted pressure, or unwanted contact if they later circulate.

Public reporting on the incident remains limited. What is known is that lockbit3 listed gerb.bg and claimed internal files had been exfiltrated in a ransomware attack. The number of people affected has not been disclosed, and independent confirmation of the full scope has not been published in the available record. For individuals connected to the party or its administration, the prudent response is to treat the claim seriously while recognising that exact exposure details are still unconfirmed.

What happened

According to the available facts, gerb.bg was listed by the lockbit3 ransomware group, with the listing reported on 1 August 2023. The group’s claim states that internal files were exfiltrated in a ransomware attack. No public figure has been given for how many people may be affected, and the facts do not describe the intrusion method, the duration of any access, whether encryption was also deployed, or whether negotiations took place. Timing beyond the reported listing date, the volume of data, and any subsequent publication of files are not detailed in the provided record. The listing itself should be understood as a claim by the threat actor rather than independently verified proof of every asserted detail.

The group behind it: lockbit3

LockBit 3 (often associated with the broader LockBit operation) is a well-documented ransomware group that has operated for years under a ransomware-as-a-service model. Affiliates typically gain access to networks, move laterally, steal data, and then deploy encryption while threatening to publish stolen material on a dedicated leak site if payment is not made. This double-extortion approach—combining operational disruption with the threat of data exposure—has been a hallmark of the group’s public activity across many sectors and countries.

LockBit has historically maintained a leak site where it names victims and, in some cases, posts samples or larger archives. The group has been linked to numerous high-profile incidents worldwide and has iterated its tooling and branding over time, including LockBit 3.0. None of that general history, however, proves specific technical details about the gerb.bg incident beyond what the listing claims. For this case, the established public fact in the record is the group’s claim that gerb.bg was hit and that internal files were taken; further assertions about this victim should be treated as unverified unless corroborated elsewhere.

Who is gerb.bg?

gerb.bg is the online presence associated with GERB, a major political party in Bulgaria. Public background on the organisation notes that it has been headed by Boyko Borisov, a former prime minister of Bulgaria, former mayor of Sofia, and a figure with a long record in Bulgarian public life, including earlier roles connected to national politics and security. Political parties of this kind typically maintain websites, membership and supporter databases, internal communications, campaign and administrative records, and correspondence with officials, staff, and the public.

A breach affecting such an organisation is consequential because political entities hold information that can be sensitive in both personal and civic terms. Even routine administrative files—staff directories, internal memos, event lists, or supporter contact data—can enable social engineering, doxxing-style harassment, or fraud if they leave controlled systems. The democratic and organisational role of a national party also means that disruption or exposure can affect trust, operations, and the privacy of people who never expected their details to surface outside official channels.

What was likely exposed

The facts name the exposed material only in general terms: internal files exfiltrated in a ransomware attack. No inventory of specific data types—such as names, national identifiers, financial records, emails, or membership lists—has been disclosed in the provided record, and the number of affected individuals is unknown.

Organisations like political parties commonly hold internal documents, staff and volunteer information, correspondence, planning materials, and databases of contacts or supporters. It is reasonable to expect that some mix of those categories could be among “internal files,” but it would be inaccurate to state that any particular category was confirmed stolen. Exact contents remain unconfirmed. Anyone who has interacted with GERB as staff, member, donor, contractor, or correspondent should assume that limited public detail does not equal zero risk, while also avoiding the assumption that every possible data type was taken.

The real-world impact

For individuals, the main risks are practical rather than abstract. If contact details or identity-related information appear in stolen internal files, affected people may face phishing, impersonation, or unwanted outreach that references real organisational context to seem legitimate. Internal documents can also reveal relationships, opinions, or private circumstances that were never meant for public or criminal use, creating pressure or reputational harm even when no financial account is directly involved.

For the organisation, ransomware incidents typically threaten operational continuity, legal and regulatory obligations around personal data, and public confidence. Even when encryption impact is unclear, the claim of exfiltration alone can force costly review of systems, notification duties where applicable, and long-term monitoring for misuse of any leaked material. Because the scale is undisclosed, the organisation and potentially affected people cannot yet rely on a clear boundary of who is in or out of scope; that uncertainty itself is part of the impact.

What to do if you're exposed

If you have a past or present connection to GERB or gerb.bg—as staff, member, supporter, vendor, or correspondent—treat the claim as a prompt to tighten basic defences. Watch for unexpected emails, messages, or calls that reference the party or internal matters; verify requests through separate known channels before sharing codes, passwords, or money. Consider changing passwords on accounts that reused credentials tied to party-related email, and enable multi-factor authentication where available. Monitor financial and government-facing accounts for unusual activity if you ever shared identity documents or payment details with the organisation.

Keep records of any suspicious contact and report clear fraud attempts to the relevant national authorities. Because public detail on this incident is limited, periodic checks of whether your email address appears in known breach datasets can provide an extra early warning. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data, then use any positive result as a cue to strengthen unique passwords and account recovery settings rather than as proof of this specific incident alone.

AICompiled with AI assistance from public sources and published under our editorial standards.