Lendco Listed by killsec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target financial and lending firms as part of a broader pattern of double-extortion attacks, in which operators claim to steal data before encrypting systems and then list victims on public leak sites to increase pressure. Against that backdrop, Lendco appeared on the killsec ransomware group's leak site in early April 2025, with the group asserting that it had taken internal files. The listing itself does not confirm the full scope or impact, yet any such claim involving a lender raises immediate questions for customers, partners and staff whose information may have been involved.

Public detail remains limited. What is known is that Lendco was named on the killsec site and that the group claims to have exfiltrated internal data during a ransomware attack. No independent confirmation of the volume, exact contents or number of people affected has been released, and the organisation has not publicly detailed the incident in the information available here.

Breaking down the breach

On or around 1 April 2025, Lendco was listed on the killsec ransomware leak site. According to the group's claim, internal files were stolen as part of a ransomware attack. The number of people affected is unknown, and no further technical details—such as the initial access method, the duration of the intrusion, or whether systems were encrypted—have been disclosed in the available record. The listing constitutes an unverified assertion by the threat actors; it does not by itself establish that data has been published or sold, only that the group is claiming possession of material taken from Lendco.

Because the facts stop at the leak-site listing and the assertion of exfiltrated internal files, any assessment of scale or confirmation must await additional public statements or forensic findings. At present the incident is known solely through that claim.

Who is killsec?

Killsec is a ransomware operation that has appeared in public reporting as a group practising double extortion: operators claim to steal data, encrypt victim systems, and then threaten to publish the material on a dedicated leak site if a ransom is not paid. Like many contemporary ransomware crews, killsec typically advertises victims on its site with brief descriptions of the alleged haul, using the listing itself as leverage. Public accounts of the group's activity describe opportunistic targeting across multiple sectors rather than exclusive focus on any single industry, and the group has been observed listing organisations of varying sizes. No specific statements by killsec about Lendco beyond the general claim of stolen internal data are recorded in the facts; the listing is therefore treated as the group's assertion rather than verified fact.

About Lendco

Lendco operates in the lending and finance sector, a field that routinely handles sensitive personal and commercial information in the course of assessing credit, originating loans and servicing accounts. Organisations of this type typically maintain customer identity records, financial histories, contact details and internal operational documents. A ransomware claim against such a firm is consequential because the data held is often long-lived and of high value for identity fraud or further social-engineering attacks. Even when the precise contents of an alleged theft remain unconfirmed, the mere listing of a lender can create uncertainty for borrowers, guarantors and business partners who must decide how to protect themselves.

The information in question

The available facts state only that internal files were claimed to have been exfiltrated in a ransomware attack. No inventory of specific data types—such as names, account numbers, credit scores or employee records—has been disclosed. Lending organisations ordinarily store a range of personal and financial material, yet it would be inaccurate to treat any particular category as confirmed in this incident. The exact contents remain unconfirmed; the public record is limited to the group's assertion that internal data was taken.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include identity theft, fraudulent loan applications, phishing attempts that reference genuine account details, and longer-term credit or privacy harm. Because the number of people affected is unknown and the data types are not itemised, the exposure cannot be quantified, but the potential for misuse of financial records is well established. For Lendco itself the stakes include operational disruption, regulatory scrutiny, reputational damage and the cost of investigation and remediation. Until more detail emerges, both the organisation and any potentially affected parties must treat the claim as a credible warning rather than a fully verified event.

What to do if you're exposed

Anyone who has done business with Lendco or believes their details may have been held by the firm should monitor financial accounts and credit reports for unexpected activity, enable multi-factor authentication on all related services, and be alert to phishing messages that appear unusually well-informed. Changing passwords associated with any Lendco-linked accounts and placing fraud alerts with credit bureaux are prudent early steps. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; such a check provides an additional, independent signal while official confirmation remains limited.

AICompiled with AI assistance from public sources and published under our editorial standards.