knvb.nl Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by pairing encryption with data theft and public leak-site listings, turning internal files into leverage. In that landscape, a claim that a national sports governing body has been hit carries weight beyond the usual corporate target list, because the data such bodies hold often touches staff, clubs, players and partners across an entire country.

On 4 April 2023, the ransomware group known as lockbit3 listed knvb.nl, the online presence of the Royal Dutch Football Association. Public reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated, with a claimed volume of 305 GB. The number of people affected remains unknown, and independent confirmation of the full scope is limited.

Breaking down the breach

According to the available record, knvb.nl was listed by lockbit3 on or around 4 April 2023. The reported summary states that internal files were exfiltrated in a ransomware attack and cites a volume of 305 GB. No public detail in the record confirms how the attackers gained access, whether systems were encrypted, when the intrusion began, or how long it lasted. The number of individuals affected is listed as unknown. Beyond the group’s leak-site claim and the stated file volume, further technical specifics have not been disclosed in the material at hand.

Because the listing originates from the threat actor, it should be treated as an unverified claim unless and until the organisation or independent investigators state the same details. What is established in the public summary is the association of the domain with a lockbit3 listing, the characterisation of the event as a ransomware attack involving exfiltration of internal files, and the 305 GB figure attached to that claim.

Who is lockbit3?

LockBit 3 (sometimes styled LockBit Black) is a well-documented ransomware operation that has operated as a Ransomware-as-a-Service model. Affiliates gain access to victim environments, exfiltrate data, deploy encryptors, and then use a public leak site to name victims and threaten release of stolen files if demands are not met. The group has been linked to numerous high-profile incidents across sectors and geographies; its tactics typically include double extortion—combining encryption with the threat of data publication—and aggressive naming of organisations on its blog to increase pressure.

In this case, lockbit3’s listing of knvb.nl constitutes the group’s claim that it holds data taken from the organisation. No additional statements attributed specifically to the group about this victim—beyond the listing and the reported 305 GB internal-file exfiltration—are included in the facts provided. Readers should therefore separate the group’s public assertion from independently verified findings.

About knvb.nl

The Royal Dutch Football Association (KNVB) is the governing body of football in the Netherlands. It organises the main Dutch football leagues, the amateur leagues, the KNVB Cup, and the Dutch men’s and women’s national teams. Its digital presence, knvb.nl, supports communication, administration and services connected to that role.

Organisations of this type routinely manage information about employees, officials, clubs, players at various levels, volunteers, and commercial or broadcasting partners. A breach affecting such a body is consequential because the data can span professional and amateur structures, national-team operations, and large numbers of people who interact with the association in official or recreational capacities. Even when exact contents remain unconfirmed, the sector context explains why a claimed exfiltration draws attention.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack, with a reported volume of 305 GB. No further breakdown of file types, databases, or individual data categories is provided, and the number of people affected is unknown. Exact contents are therefore unconfirmed.

Organisations in this position typically hold a mix of administrative and operational records. Without confirmation, it is not possible to state what was actually taken. In general terms, bodies that run national leagues and teams may retain:

• Staff and contractor records, including contact and employment-related information
• Club, player and registration data across professional and amateur levels
• Correspondence, contracts and planning documents with partners or event stakeholders
• Internal operational files related to competitions, logistics and national-team activity

None of the above should be read as a claimed inventory of this incident. They illustrate only what is commonly held in the sector; the public record here does not itemise the 305 GB claim beyond “internal files.”

What's at stake

For individuals, the practical risks depend on what was in those files. If personal or contact data were included, affected people could face phishing, social-engineering attempts, or misuse of identity details. If registration, medical, or financial-adjacent information were present—again unconfirmed—the sensitivity would be higher. Because the scale of personal impact is unknown, anyone with a past relationship to the KNVB should treat unsolicited messages that reference football administration, payments, or account issues with caution.

For the organisation, a claimed exfiltration of internal files raises operational, legal and reputational considerations: potential disruption to administrative systems, obligations under data-protection rules to assess and notify where personal data are involved, and the need to support clubs and individuals who may be uncertain whether they are affected. The absence of a published count of affected people leaves that assessment incomplete from the outside.

Were you affected?

If you have worked for, registered with, or otherwise shared personal information with the Royal Dutch Football Association, consider basic precautions: be wary of unexpected emails or messages that urge urgent action; enable multi-factor authentication on important accounts; and monitor financial or identity alerts if you have reason to believe sensitive details were held. Public detail on this incident does not identify specific individuals, so there is no definitive public list of affected people.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this particular incident, but it can indicate whether your credentials or personal details appear elsewhere and help you prioritise password changes and further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.