lankacom.net Listed by darkvault Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For customers, employees and partners of a national telecommunications provider, a reported data breach raises immediate questions about personal records, account details and communications that may now sit outside the organisation’s control. When a ransomware group claims to have taken internal files, the practical stakes centre on whether private information could be misused for fraud, account takeover or further targeting.

Public reporting on 14 March 2024 stated that lankacom.net had been listed by the darkvault ransomware group. The number of people affected remains unknown, and the precise contents of any taken material have not been independently confirmed. What is known is limited to the group’s claim of a ransomware attack involving the exfiltration of internal files.

Inside the incident

According to the available record, lankacom.net appeared on a darkvault leak-site listing dated 14 March 2024. The report characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data, the number of systems involved, or the exact date the intrusion began. Method of initial access, duration of presence inside the network, and whether encryption was also deployed remain undisclosed. The listing itself constitutes a claim by the group rather than an independently verified confirmation of every asserted detail.

Because the scale of impact and the full inventory of taken material have not been published by the organisation or by independent investigators, any assessment of the incident must stay within these bounds. Public detail is limited to the reported listing and the description of internal-file exfiltration.

The group behind it: darkvault

darkvault is a ransomware operation that follows the now-common double-extortion model: data is copied from a victim network and then encryption is threatened or applied, with the threat of public release used to pressure payment. Groups of this type typically maintain dedicated leak sites where they post victim names, sample files and countdown timers. They often advertise themselves as “data brokers” as much as encryptors, emphasising the value of the stolen material.

Public reporting on darkvault has described the group’s use of standard initial-access techniques—phishing, exploitation of unpatched internet-facing services, and compromised credentials—followed by lateral movement and bulk data collection before any ransom note is delivered. The group’s listings are claims; they do not automatically prove that every file advertised was in fact taken or that the victim has validated the intrusion. In the case of lankacom.net, the only assertion on record is the group’s own listing of the organisation and the statement that internal files were exfiltrated.

lankacom.net and its sector

LankaCom is a Sri Lanka–based telecommunications company founded in 1991. It operates as a subsidiary of Singtel and was the first entity granted a Communication Operator License in the country. As a licensed telecoms provider it sits at the centre of national voice, data and internet services, handling customer accounts, network infrastructure records, billing systems and operational documentation.

Telecommunications operators routinely process large volumes of subscriber information, call-detail records, service-configuration data and internal corporate files. A breach affecting such an organisation is consequential because the data can touch both individual customers and the continuity of critical communications infrastructure. Even when the exact files taken remain unconfirmed, the sector’s role makes any credible claim of compromise a matter of public interest.

The information in question

The only data type named in the public record is “internal files” said to have been exfiltrated during a ransomware attack. No further breakdown—customer databases, employee records, network diagrams, financial documents or otherwise—has been disclosed. Organisations of this kind typically hold subscriber personal data, account credentials, billing histories, technical configuration files and internal correspondence. Whether any of those categories were among the material claimed by darkvault is unconfirmed.

Because the precise inventory has not been released, it is not possible to state as fact which specific fields or records are exposed. The reported description remains limited to the general category of internal files.

The real-world impact

For individuals whose information may have been among the taken files, the concrete risks include targeted phishing that references genuine account details, attempts to reset online credentials, and the possibility that contact or identity data could be sold or reused in other fraud schemes. Employees could face similar exposure of personal or payroll-related records. For the organisation itself, the consequences include potential regulatory scrutiny, the cost of forensic investigation and customer notification, and reputational damage that can affect trust in a critical service provider.

None of these outcomes is guaranteed; they depend on what was actually taken and how it is later used. With the number of affected people still unknown and the file contents unconfirmed, the impact remains a range of plausible risks rather than a measured tally of harm.

If your data was in this claimed breach

Until more detail emerges, people who have held accounts or employment with LankaCom can take a small number of practical steps to reduce immediate risk:

• Change passwords on any LankaCom-related accounts and on other services where the same password may have been reused; enable multi-factor authentication wherever it is offered.
• Monitor bank and mobile-money statements for unfamiliar charges and set transaction alerts if available.
• Treat unsolicited calls, texts or emails that reference account numbers or personal details with caution; verify through official channels before responding.
• Request a free credit or identity-monitoring check if one is offered by local financial institutions or government services.
• Run a free exposure scan of your email address against known breach data sets to see whether that address has already appeared in other public leaks.

These measures do not reverse any data that may have left the organisation, but they limit the usefulness of that data for further abuse while official confirmation remains limited.

AICompiled with AI assistance from public sources and published under our editorial standards.