grantierra.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out energy producers as high-value targets, knowing that operational disruption and the exposure of sensitive corporate and personal records can create intense pressure. In that broader pattern sits the May 2023 listing of grantierra.com by the LockBit3 ransomware operation, an incident that brought an established oil-and-gas explorer into the public view of cyber-extortion activity.

What is known comes chiefly from the group's own leak-site claim and limited contemporaneous reporting: Gran Tierra Energy was named, a substantial volume of internal material was said to have been taken, and the episode was recorded on 24 May 2023. The number of people affected remains unknown, and many operational details have never been confirmed by the company in public sources. Even so, the combination of an energy-sector victim and a well-known ransomware brand makes the case worth examining carefully for anyone who may have dealt with the organisation.

Inside the incident

Public reporting states that Gran Tierra Energy, operating under the grantierra.com domain, was listed by the LockBit3 ransomware group on or about 24 May 2023. According to the available summary, the attackers claimed to have exfiltrated more than 150 gigabytes of internal files during a ransomware attack. Among the material referenced were passports of directors and employees, together with other company records whose full scope was not exhaustively catalogued in open sources.

No independent confirmation of the precise intrusion method, the duration of access, or the exact date of initial compromise has been published in the material provided. The number of individuals whose data may have been involved is listed as unknown. What stands as fact is the leak-site listing itself and the description of a large-scale file exfiltration tied to a ransomware event. Beyond those points, timing, technical entry vector, and any ransom demand or negotiation remain undisclosed in the public record drawn on here.

The group behind it: lockbit3

LockBit3 is the third major iteration of the LockBit ransomware-as-a-service operation, a long-running criminal enterprise that has ranked among the most prolific ransomware actors of recent years. The group typically recruits affiliates who gain initial access to victim networks, deploy the encryptor, and exfiltrate data before encryption in a double-extortion model. Stolen files are then leveraged on a dedicated leak site to increase pressure if payment is refused.

LockBit affiliates have historically favoured broad targeting across manufacturing, professional services, healthcare, and energy, often using phishing, compromised credentials, or exploitation of exposed remote-access services. Once inside, they move laterally, disable defences where possible, and stage large data transfers. The group's leak site functions as both a pressure mechanism and a public claim of responsibility; listings are assertions by the criminals and are not, by themselves, independent verification of every detail. In this instance, LockBit3's listing of grantierra.com constitutes the group's claim that it held and intended to release the described material.

grantierra.com and its sector

Gran Tierra Energy is an oil and gas exploration and production company founded in 2005 and headquartered in Calgary, Canada, with core operations focused on Colombia and Ecuador. Companies of this type manage geological and reservoir data, joint-venture and regulatory filings, financial records, employee and contractor information, and the personal identification documents required for international travel, work permits, and compliance in multiple jurisdictions.

A breach affecting an upstream energy firm is consequential because the sector sits at the intersection of critical infrastructure, cross-border regulation, and substantial personal data. Disruption or exposure can affect not only corporate continuity but also the privacy of staff, directors, and partners who must routinely share sensitive identity documents to operate in the regions where the company is active.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that the volume claimed exceeded 150 gigabytes. Specific items referenced include passports of directors and employees, along with other company material. The precise inventory of every file type has not been fully disclosed in the public summary, and the total number of affected individuals is unknown.

Organisations in exploration and production commonly hold passport and visa copies, national identity documents, payroll and human-resources files, contracts, technical reports, and correspondence with regulators and partners. While those categories are typical for the sector, only the elements explicitly named—internal files and the passport material cited—can be treated as part of the reported claim. Everything else remains unconfirmed.

Why it matters

For individuals, the exposure of passport images and related identity documents creates lasting risks of identity fraud, impersonation in financial or travel contexts, and targeted social engineering. Once such documents leave an organisation's control, they can circulate indefinitely among criminal markets even if the original ransomware operators later remove them from a leak site.

For the organisation, a ransomware incident of this kind raises operational, legal, and reputational questions: potential regulatory notification duties in Canada and in the jurisdictions where it operates, possible contractual obligations to partners, and the cost of investigating and containing the event. Because the headcount of affected people is unknown, the full human scope cannot yet be measured, which itself complicates notification and support efforts.

Were you affected?

If you are a current or former employee, director, contractor, or partner of Gran Tierra Energy, treat the possibility of exposure seriously. Monitor financial and identity accounts for unusual activity, consider placing fraud alerts where available, and be alert to phishing or impersonation attempts that reference the company or personal details. Retain any official notices you may receive from the organisation and follow guidance from relevant data-protection authorities.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your wider exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.