hkiff.org.hk Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 17 April 2023, the Hong Kong International Film Festival Society, known online as hkiff.org.hk, was listed by the ransomware group lockbit3. Public reporting states that internal files were exfiltrated in a ransomware attack. How many people may be affected remains unknown, and the precise contents of those files have not been detailed in the available record.

For anyone who has dealt with the organisation—staff, partners, volunteers, filmmakers, or members of the public who shared personal or professional details—the practical stake is straightforward: internal material held by a cultural non-profit can include contact data, correspondence, and operational records. Until more is confirmed, the prudent response is to treat the claim seriously and take basic protective steps.

Inside the incident

According to the reported facts, hkiff.org.hk was listed by lockbit3 on or around 17 April 2023. The summary describes internal files as having been exfiltrated in a ransomware attack. No public figure has been given for the number of people affected. The method of initial access, the exact timing of the intrusion, the volume of data taken, and any ransom demand or payment outcome are not disclosed in the available record.

What is known is limited to the listing itself and the characterisation of the material as internal files. There is no confirmed independent verification in the facts provided that would turn the group’s claim into established fact beyond the report of the listing and the description of exfiltration. Details such as file counts, specific systems involved, or timelines of discovery and response remain undisclosed.

Inside lockbit3

Lockbit3 is a well-documented ransomware operation that has, over successive iterations, run a Ransomware-as-a-Service model. Affiliates gain access to victim networks, deploy encryption, and often exfiltrate data before locking systems. The group has historically maintained a leak site on which it names organisations and, in many cases, threatens to publish stolen data if its demands are not met. Public reporting over years has associated Lockbit variants with attacks across many sectors and countries; the group’s typical pattern includes double-extortion pressure—encryption plus the threat of data release.

In this case, the facts state that hkiff.org.hk was listed by lockbit3 and that internal files were exfiltrated. Any further assertion the group may have made specifically about this victim beyond that listing and description is not detailed here. The listing should be read as the group’s claim. Lockbit’s broader history does not by itself prove the full scope or accuracy of every individual claim on its site; each incident still rests on what can be corroborated.

Who is hkiff.org.hk?

The Hong Kong International Film Festival Society (HKIFFS) is described as a charitable, non-profit and non-governmental organisation dedicated to the discovery and promotion of creativity in the art and culture of film. Organisations of this kind typically run festivals, screenings, industry programmes, and related cultural activity. They commonly hold records on staff and contractors, filmmakers and submitters, partners, sponsors, volunteers, and members of the public who register for events or mailing lists.

A breach affecting such an organisation matters because cultural and festival bodies sit at the intersection of personal data, professional reputations, and operational planning. Even when the public mission is artistic rather than commercial, the data they hold can still identify people, reveal contact paths, and expose internal working documents. Disruption or exposure can affect trust with artists, audiences, and funders, and can create lasting administrative and reputational work for a non-profit with limited resources.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as whether the files included databases, email archives, HR records, financial documents, or submission materials—is provided. The number of individuals tied to those files is unknown.

Organisations like a film-festival society commonly hold names, email addresses, phone numbers, postal details, accreditation or registration information, correspondence, contracts, and internal planning documents. Some may also hold payment or donation-related records, depending on how ticketing and fundraising are run. None of that typical profile should be read as confirmation of what was taken here. The exact contents remain unconfirmed beyond the description “internal files.”

The real-world impact

For individuals, the concrete risks depend on what those internal files actually contained. If contact details or identity-linked records were included, people may face phishing, social-engineering attempts, or unwanted contact that references the organisation. If professional or submission-related material was involved, there can be privacy and reputational concerns for filmmakers and partners. Because the scale and data types are not fully disclosed, affected people cannot yet know with certainty how exposed they are; that uncertainty itself is part of the harm.

For the organisation, a ransomware incident that includes exfiltration typically means operational disruption, forensic and recovery costs, possible regulatory or contractual notification duties, and damage to relationships with artists, audiences, and supporters. A charitable non-profit may feel those pressures acutely. None of this establishes negligence as fact; it describes the ordinary consequences such incidents create when internal material leaves an organisation’s control under criminal pressure.

If your data was in this claimed breach

If you have a past relationship with the Hong Kong International Film Festival Society—employment, volunteering, submissions, registration, or correspondence—treat unsolicited messages that reference the festival or your dealings with it with caution. Prefer official channels you already trust. Consider changing passwords for accounts where you reused credentials connected to festival-related email, and enable multi-factor authentication where available. Monitor financial and email accounts for unusual activity if you ever shared payment or sensitive personal details with the organisation.

Keep records of any suspicious contact. Public detail on this incident remains limited: the people affected are unknown, and only internal files are named as exfiltrated. You can run a free exposure scan of your email to check whether your information has surfaced in known breach data, which may help you decide what to secure next.

AICompiled with AI assistance from public sources and published under our editorial standards.