Lomma Crane & Rigging Listed by trigona Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 25, 2024, Lomma Crane & Rigging, also identified in public records as J.F. Lomma, Inc., was listed by the ransomware group known as Trigona. Public reporting indicates that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and further operational details of the incident have not been disclosed.

The listing places the company among those claimed as victims by the group. For individuals or partners who may have shared information with the firm, the core concern is the potential exposure of internal material whose precise contents and scope have not been confirmed publicly.

Breaking down the breach

According to available reporting, Lomma Crane & Rigging was listed by Trigona on or around January 25, 2024. The sole concrete detail provided is that internal files were allegedly exfiltrated in a ransomware attack. No public information has been released about the initial access method, the duration of unauthorized presence on systems, the volume of data taken, encryption of systems, or any ransom demand. The number of individuals whose data may be involved is listed as unknown. All other elements of timing, scale, and technical execution remain undisclosed.

The group’s leak-site listing constitutes a claim that the company was compromised and that data was removed. Independent confirmation of the full extent of the incident has not been supplied in the available facts, so the listing should be treated as an assertion by the threat actor rather than a fully verified account.

Inside trigona

Trigona is a ransomware operation that became publicly active in 2022. Like many contemporary groups, it has employed a double-extortion model: encrypting systems while also copying data and threatening to publish or sell it if payment is not made. The group has historically posted victim names and sample files on dedicated leak sites to increase pressure. Its targets have spanned multiple industries and geographies rather than focusing on a single sector.

Public documentation of Trigona’s activity shows typical ransomware tactics—phishing or exploitation of remote-access services for initial entry, followed by lateral movement, data staging, and deployment of encryptors. The group has been observed using custom tools and, at times, affiliate-style recruitment. None of these general patterns should be read as confirmed steps in the Lomma Crane & Rigging incident; they simply describe how the actor has operated elsewhere. With respect to this specific listing, the only claim on record is that internal files were exfiltrated.

Lomma Crane & Rigging and its sector

J.F. Lomma, Inc., operating as Lomma Crane & Rigging, is a provider of crane services, equipment, and rigging solutions serving the construction industry. Companies of this type typically manage heavy equipment fleets, project schedules, client contracts, employee records, vendor relationships, and site logistics. They often hold operational data that includes work orders, safety documentation, insurance details, and correspondence with general contractors and subcontractors.

A breach at a specialized industrial-services firm carries consequences beyond the company itself. Construction projects rely on coordinated equipment availability and clear chains of responsibility. Exposure of internal files can disrupt bidding processes, reveal pricing or capacity information to competitors, or place personal data of employees and project contacts at risk. Because the sector handles both commercial and workforce information, the potential ripple effects extend to job sites, insurance carriers, and partner firms that exchange data with the operator.

The information in question

The available facts state only that internal files were exfiltrated. No inventory of specific data types—such as employee Social Security numbers, customer contracts, financial records, or project blueprints—has been published. Exact contents therefore remain unconfirmed.

Organizations in the crane and rigging sector commonly store employee personnel files, payroll data, client contact lists, equipment maintenance logs, insurance certificates, and contractual documents. Any of these categories could theoretically be present among internal files, yet none can be asserted as fact in this case. Until a detailed disclosure or forensic summary appears, the nature of the material must be treated as unknown beyond the broad description of “internal files.”

The real-world impact

For people whose information may have been among the files, the primary risks are identity-related misuse, targeted phishing that references genuine project or employment details, and potential fraud against financial or insurance accounts. Because the scale is unknown, it is impossible to quantify how many individuals face elevated risk. Even a limited set of internal documents can supply enough context for convincing social-engineering attempts.

For the organization, consequences can include operational disruption if systems were encrypted, contractual or regulatory obligations to notify partners and employees, reputational damage among construction clients who depend on reliable equipment providers, and possible legal or insurance costs. The absence of public figures on ransom amounts or recovery timelines means these impacts cannot be measured precisely from the current record. The listing itself, however, already signals that sensitive material left the company’s control.

If your data was in this claimed breach

If you have worked for, contracted with, or supplied personal or business information to Lomma Crane & Rigging or J.F. Lomma, Inc., treat the possibility of exposure seriously even though the exact data set is unconfirmed. Monitor financial and credit accounts for unusual activity, enable multi-factor authentication on email and any accounts that reuse credentials, and be alert for phishing messages that reference crane services, construction projects, or employment details. Consider placing a fraud alert with major credit bureaus if you believe sensitive identifiers may have been involved.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan does not prove or disprove involvement in this specific incident, but it provides a practical starting point for personal risk assessment while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.