ibb-business-team.de Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations that sit at the intersection of public funding and private enterprise, using leak-site listings to pressure victims after data theft. In that landscape, the appearance of a Berlin-based financing body on a known ransomware blog is a signal that internal material may have left the organisation’s control, even when full confirmation and scale remain limited.

On 22 January 2023, ibb-business-team.de was listed by the lockbit3 ransomware group. Public reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The number of people affected is unknown, and wider technical detail has not been disclosed. For start-ups, small and medium-sized enterprises, and others who deal with Berlin’s public financing channels, the listing raises practical questions about what may have been copied and how to respond.

What happened

According to available public information, ibb-business-team.de was listed by lockbit3 on or around 22 January 2023. The reported summary characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data, the number of affected individuals, or the precise intrusion method. Timing beyond the reported listing date, ransom demands, and any confirmation of decryption or recovery steps are undisclosed. The leak-site listing itself constitutes a claim by the group rather than independent verification of every asserted detail.

What is stated is limited: the organisation appeared on the lockbit3 listing, and the incident is described as involving exfiltration of internal files in a ransomware context. Beyond that, public detail is sparse.

The group behind it: lockbit3

Lockbit3 is a well-documented ransomware operation that has functioned as a ransomware-as-a-service model, in which affiliates conduct intrusions and deploy encryptors while the core group maintains branding, negotiation channels, and a public leak site. The group’s typical pattern involves gaining access, moving laterally, stealing data before encryption, and then threatening to publish the stolen material if payment is not made—a double-extortion approach widely observed across many of its campaigns.

Lockbit3 and its predecessors have been associated with numerous listings of organisations across sectors and countries. Listings on its blog are claims intended to increase pressure; they do not by themselves prove the full scope of any single intrusion. In this case, the group claims to have listed ibb-business-team.de in connection with a ransomware attack involving internal files. No further victim-specific statements from the group are included in the available facts, and nothing beyond that claim should be treated as established fact about this incident.

ibb-business-team.de and its sector

IBB Business Team GmbH is described as a 100 percent subsidiary of the IBB Group. On behalf of the State of Berlin and the Investment Bank of Berlin (IBB), it implements various grants and financing offers aimed at start-ups, small and medium-sized enterprises, and real-estate-related activity in Berlin. Organisations of this type sit between public policy goals and private applicants: they handle applications, eligibility checks, contractual documents, and ongoing administration of support programmes.

Because such bodies process commercially and sometimes personally sensitive material from applicants and partners, a breach affecting their systems is consequential. Exposure can affect not only the subsidiary itself but also the wider trust placed in public-backed financing channels in the region. The facts do not allege negligence; they simply record that the organisation was listed in connection with a claimed ransomware incident involving internal files.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of specific categories such as personal identity data, bank details, or full application dossiers have been publicly disclosed. Exact contents therefore remain unconfirmed.

Organisations that administer grants and financing for start-ups, SMEs, and real-estate projects typically hold materials such as application forms, business plans, contact details for founders and officers, contractual correspondence, and internal assessments. It is reasonable to expect that internal files could include some mixture of those categories, but it would be inaccurate to state that any particular data type was definitively taken. Readers should treat the scope as unknown until corroborated by the organisation or independent reporting.

What's at stake

For individuals and companies that have interacted with IBB Business Team—applicants, grantees, partners, or staff—the primary risks are misuse of any contact or commercial information that may have been among the internal files, targeted phishing that references real programme names or application details, and longer-term uncertainty about whether sensitive business information could appear in secondary leaks. Because the number of people affected is unknown, it is not possible to quantify how widely those risks extend.

For the organisation, stakes include operational disruption from a ransomware event, potential regulatory and contractual obligations around notification, and reputational pressure that follows any public listing by a ransomware group. None of these outcomes is confirmed in the public facts as having fully materialised; they are the concrete consequences that commonly follow this class of incident when internal files are claimed to have been stolen.

What to do if you're exposed

If you have dealt with ibb-business-team.de or related IBB financing programmes, treat unsolicited messages that reference grants, applications, or Berlin funding schemes with caution. Prefer official channels you already trust when checking the status of any application or contract. Monitor financial and email accounts for unusual activity, and consider updating passwords on accounts that may have shared credentials or recovery addresses with programme correspondence. Preserve any suspicious messages rather than clicking links inside them.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm involvement in this specific incident, but it can help you prioritise further monitoring and password hygiene if your address surfaces elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.