kostika.co.il Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In early February 2023, the Israeli construction-solutions firm kostika.co.il appeared on a ransomware group’s leak site, with the operators claiming they had taken a large volume of internal files. For anyone who has worked with, contracted, or been employed by the company, the practical question is straightforward: whether business records, project materials, or personal details tied to those files could now be in unauthorized hands, and what that could mean for privacy, contracts, and day-to-day security.

Public reporting on the incident is limited. The number of people affected has not been established, and independent confirmation of the full scope remains thin. What is known comes largely from the listing itself and the claim that internal material was removed during a ransomware attack. That is enough to warrant careful attention from anyone connected to the organisation, even while many specifics stay undisclosed.

Inside the incident

According to available records, kostika.co.il was listed by the LockBit3 ransomware group, with the matter reported on 2 February 2023. The group’s claim centres on the exfiltration of internal files in a ransomware attack, with the volume described as 250GB stolen. Beyond that figure and the characterisation of the material as internal files, public detail on timing of the intrusion, initial access method, encryption of systems, negotiation, or any recovery steps is not disclosed in the material at hand.

No confirmed count of affected individuals has been published. The listing should be treated as an assertion by the threat actors rather than as independently verified proof of every claimed detail. Ransomware operations of this type commonly pair data theft with pressure to pay, sometimes by threatening to publish or sell what was taken; whether any of the claimed material was later released, and in what form, is not established in the facts provided here.

Who is lockbit3?

LockBit3 is a well-documented ransomware operation that has operated as a ransomware-as-a-service model, in which core developers supply tools and infrastructure to affiliates who carry out intrusions. The brand is associated with double-extortion tactics: encrypting systems where possible while also copying data and threatening to leak it on a dedicated site if demands are not met. The group has been linked over time to a large number of victims across sectors and countries, and its leak site has been used to name organisations and, in some cases, to post samples or larger archives.

Public reporting on LockBit has described evolving versions of its malware, affiliate recruitment, and pressure campaigns aimed at maximising leverage. None of that general background, however, proves the precise contents or completeness of any single victim listing. In this case, the group claims kostika.co.il as a victim and claims theft of internal files on the order of 250GB; those claims are attributed to the actors and are not independently confirmed by the facts given here.

About kostika.co.il

Kostika.co.il presents itself as part of a group with long experience translating architectural plans into practical construction solutions—work that can involve projects of varied height, shape, and complexity. Organisations in this sector typically sit at the intersection of design, engineering, contracting, and client delivery. They often hold project documentation, drawings, schedules, supplier and subcontractor details, commercial correspondence, and internal administrative records.

A breach affecting such a firm is consequential because construction and fit-out work depends on trust in plans, pricing, timelines, and the confidentiality of client and partner information. Disruption or exposure can affect not only the company but also architects, builders, property owners, and others whose projects or personal data may appear in shared files. The .co.il domain places the organisation in an Israeli business context, where local clients and partners may have particular expectations around data handling and continuity.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack, with a claimed volume of 250GB. No further breakdown—such as employee lists, customer databases, financial ledgers, or specific document categories—is provided in the available record. The exact contents therefore remain unconfirmed beyond that high-level description.

Firms that convert architectural intent into buildable solutions commonly store technical drawings, specifications, correspondence, contracts, invoices, and operational records. They may also hold contact details for staff, clients, and suppliers. It is reasonable to note that such categories are typical for the sector; it is not established that any particular category was present in the claimed 250GB set. Readers should treat the composition of the haul as unknown until more authoritative disclosure appears.

What's at stake

For individuals, the main risks are misuse of any personal or contact data that may have been among internal files, targeted phishing that references real projects or colleagues, and, in some cases, fraud that exploits knowledge of contracts or payments. For business partners, exposure of commercial terms, designs, or schedules could create competitive or contractual harm. For the organisation, stakes include operational disruption, reputational damage, possible regulatory attention depending on what was held, and the cost of investigation and remediation—none of which is quantified in the public facts here.

Because the number of people affected is unknown and the file-level inventory is undisclosed, the prudent stance is to assume that anyone with a meaningful relationship to kostika.co.il could be in scope until shown otherwise, without inflating the incident beyond what has been claimed.

What to do if you're exposed

If you have worked with, been employed by, or supplied kostika.co.il, treat unsolicited messages that reference the company or specific projects with caution. Prefer official channels when verifying any request for money, credentials, or documents. Consider changing passwords on accounts that may have been reused in work contexts, and enable multi-factor authentication where it is available. Monitor financial and email accounts for unusual activity. If you believe sensitive personal data may have been involved, follow guidance from local authorities or a trusted adviser on credit or identity monitoring appropriate to your country.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets—an additional, practical step that helps you judge whether your details are circulating more widely and whether further hardening of your accounts is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.