iibg.ca Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 26, 2021, the domain iibg.ca appeared on a listing published by the ransomware operator lockbit2. The entry states that internal files were taken during a ransomware incident, though the number of people affected and the precise contents of any files remain undisclosed. This development matters because organizations that maintain internal records often hold information that can be used for identity-related activity or other targeted misuse if it reaches public circulation.

What happened

The incident is known only through the lockbit2 listing. The group posted iibg.ca on its leak site and asserted that internal data had been removed. No independent confirmation of the volume of data, the method of access, or the date of the underlying intrusion has been made public. The number of individuals whose information may be involved is also not reported.

The group behind it: lockbit2

Lockbit2 is a ransomware operation that has conducted multiple campaigns since at least 2020. Its documented pattern involves gaining access to corporate networks, encrypting systems, and copying files before demanding payment. When organizations do not pay, the group has placed file listings or samples on a publicly accessible site to increase pressure. The appearance of iibg.ca follows this established sequence, though the group’s specific claims about this victim have not been verified by outside sources.

Who is iibg.ca?

iibg.ca is the online presence of an organization that maintains internal operational files. Entities operating under Canadian .ca domains commonly handle records related to clients, staff, or business processes. A listing on a ransomware leak site draws attention to the organization because any exposure of such records can affect the individuals whose details appear in them.

What data was at risk

The listing refers only to “internal files.” No inventory of file types or data categories has been released. Organizations of this kind routinely store employee records, contact information, and administrative documents, yet the exact material removed in this case is unconfirmed.

What's at stake

Individuals whose details appear in internal files face the possibility that those details could be used for account takeover attempts or other targeted actions if the material circulates. The organization itself may encounter regulatory scrutiny or operational disruption while addressing the incident. Both outcomes depend on the sensitivity of the specific files involved, which has not been disclosed.

What to do if you're exposed

Anyone who believes their information may have been held by iibg.ca can take the following steps:

• Review recent account statements and login activity for any unrecognized access.
• Change passwords for accounts that may share credentials with the organization.
• Enable multi-factor authentication on email and financial services where available.
• Request a copy of any personal data the organization holds, if applicable under privacy law.

Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.