globalcommunities.org Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 28, 2023, the global development organization globalcommunities.org was listed by the ransomware group known as lockbit3. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details of the incident have not been disclosed.

For an organization that works across dozens of countries on housing, community development, and related programs, any confirmed or claimed exposure of internal material raises practical questions for staff, partners, and the communities it serves. What follows summarizes only what has been reported and places it in context without speculation.

Inside the incident

According to available public information, globalcommunities.org appeared on a lockbit3 leak-site listing dated February 28, 2023. The reported summary describes the event as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure for the volume of data, no technical description of the initial access method, and no official confirmation of the full scope have been included in the facts provided. The number of individuals potentially affected is listed as unknown.

Because the primary public signal is the group’s own listing, the claim that lockbit3 was responsible and that data was taken should be treated as an assertion by the threat actor rather than as independently verified detail. Timing beyond the reported date, the precise systems involved, and any negotiation or recovery steps remain undisclosed in the material at hand.

Who is lockbit3?

LockBit 3 (sometimes styled LockBit3 or LockBit Black) is a well-documented ransomware operation that has appeared frequently in public breach reporting. Like other ransomware-as-a-service groups, it typically gains access to an organization’s network, steals data, encrypts systems, and then pressures the victim by threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has been linked to numerous incidents across sectors, including non-profits, commercial firms, and public entities.

Its public leak sites have historically been used both to name victims and, in some cases, to release sample files as proof of exfiltration. Those listings are claims made by the operators. In this instance, the facts state only that globalcommunities.org was listed and that internal files were described as exfiltrated; no further specific statements attributed to lockbit3 about this victim are provided here, and none should be invented.

About globalcommunities.org

Global Communities is a global development non-profit that, according to the reported summary, has grown to work in more than 35 countries each year. It was founded in 1952 as the Cooperative Housing Foundation and originally focused on providing affordable housing for low-income families. Over time it has expanded into broader community-development, humanitarian, and related programming.

Organizations of this type routinely handle operational records, partner and donor information, program data from the field, and personal details of staff and sometimes beneficiaries. A ransomware incident affecting such an entity is consequential because the work often involves vulnerable populations, cross-border partners, and sensitive program documentation. Even when the exact contents of any stolen files are not public, the mere listing can disrupt operations, strain trust with funders and local partners, and create follow-on risk for people whose information may have been held in internal systems.

The information in question

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of specific data categories—such as names, contact details, financial records, health or identity documents, or program beneficiary lists—has been disclosed in the provided record. The number of people affected is explicitly unknown.

Development and housing-focused non-profits commonly maintain employee and contractor records, donor and grant files, contracts, internal correspondence, and field-program data that can include personal information about community members. Whether any of those categories were present in the files lockbit3 claims to have taken has not been confirmed publicly in the material available. Readers should therefore treat the precise contents as unconfirmed.

What's at stake

For individuals, the practical risks depend on what was actually in the exfiltrated files. If personal or contact data were included, affected people could face phishing, social-engineering attempts, or other misuse of that information. If operational or partner documents were taken, there may be secondary risks to ongoing programs or to local organizations that shared information with Global Communities. Because the scale and exact data types remain unknown, these remain potential rather than proven harms.

For the organization itself, a ransomware event can mean temporary loss of systems, costly recovery, reputational pressure from a public leak-site listing, and the need to notify partners, regulators, or affected individuals once the scope is better understood. Non-profits often operate with limited cybersecurity budgets, which can prolong recovery, yet the facts do not establish negligence or assign fault; they simply record that a listing and a claim of file exfiltration occurred.

Were you affected?

If you have worked with, donated to, or received services connected to Global Communities, monitor account statements and be alert for unexpected messages that reference the organization or that urge urgent action. Change passwords on related accounts if you reuse credentials, and enable multi-factor authentication where available. Consider placing fraud alerts with credit bureaus if you believe sensitive personal data may have been involved, once more concrete information emerges.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal monitoring while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.