granules.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 14 June 2023, the ransomware group known as lockbit3 publicly listed granules.com on its leak site, claiming it had exfiltrated internal files from the organisation. The number of people whose information may be involved remains unknown, and independent confirmation of the full scope has not been published. For employees, partners, suppliers or others whose details sit inside a pharmaceutical company’s systems, a listing of this kind raises practical questions about whether personal or business data could later appear online or be misused.

Public detail is limited to the group’s own statements and the basic fact of the listing. What follows sets out only what is known, places the claim in context, and outlines the concrete risks and steps people can take.

What happened

According to reporting dated 14 June 2023, lockbit3 added granules.com to its leak site and asserted that internal files had been exfiltrated in a ransomware attack. The group’s accompanying statement claimed that during what it described as a “pentest” of the corporate network it found more than ten critical vulnerabilities that allowed access to private data; the published text is truncated and continues only with a fragmentary remark about the company. No independent verification of the intrusion method, the volume of data taken, or the precise date of any attack has been released in the available record. The number of people affected is listed as unknown. Beyond the group’s claim that internal files were removed, further technical or operational detail remains undisclosed.

Who is lockbit3?

LockBit 3 (also styled LockBit3 or LockBit Black) is a well-documented ransomware operation that has been active for several years. Like other ransomware-as-a-service groups, it typically gains access to corporate networks, steals data, encrypts systems, and then pressures victims by threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has claimed responsibility for numerous incidents across many sectors and geographies; its public posts are claims until corroborated by the victim or by independent investigators. In this case, the listing of granules.com and the accompanying commentary about vulnerabilities and exfiltrated files should be read as assertions by the group, not as confirmed findings.

Who is granules.com?

Granules.com is associated with Granules India, a pharmaceutical manufacturer. Companies in this sector develop, produce and supply active pharmaceutical ingredients and finished dosage forms; they routinely hold manufacturing records, quality and regulatory documentation, commercial contracts, employee information, and data relating to customers, suppliers and distribution partners. A breach affecting such an organisation is consequential because the data it holds can include commercially sensitive material and personal information about staff and business contacts, and because disruption or exposure can affect supply chains and regulatory standing. The available facts do not establish how the company responded or what systems were involved.

What was likely exposed

The only data type named in the record is “internal files exfiltrated in a ransomware attack.” No inventory of file names, databases, or categories of personal information has been published, and the number of affected individuals is unknown. Organisations of this kind typically maintain human-resources records, email and messaging archives, financial and procurement files, research or production documentation, and partner or customer contact details. Whether any of those categories were among the material the group claims to have taken is unconfirmed. Readers should treat specific content as unverified until the organisation or a competent authority provides a clearer account.

The real-world impact

For individuals, the main risks are secondary misuse of any personal data that may have been included among the internal files—such as phishing that references real names, roles or internal projects, or attempts at identity fraud if contact or identity details were present. Because the exact contents are undisclosed, the severity for any one person cannot be stated with certainty. For the organisation, a public ransomware listing can damage trust with partners and regulators, create operational distraction, and, if encryption or further leaks occurred, interrupt production or compliance processes. None of these outcomes is confirmed by the sparse public record; they are the ordinary consequences that follow when internal material is claimed to have left a corporate network without authorisation.

Were you affected?

If you have worked for, contracted with, or otherwise shared personal or business information with Granules India or granules.com, treat the possibility of exposure seriously until more is known. Monitor financial and email accounts for unusual activity, be cautious of unsolicited messages that appear to reference internal matters, and consider placing fraud alerts with relevant credit or identity services if you believe sensitive personal data may have been involved. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Official notifications, if any are issued by the company or by regulators, remain the most reliable source of confirmation for this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.