Lonrho Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Lonrho Listed by avaddon Ransomware Group (reported September 9, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
Ransomware groups have increasingly turned to public leak sites to pressure victims after encryption, a tactic that has become a standard feature of the threat landscape in recent years. On 9 September 2021 the Avaddon group listed Lonrho on its site, claiming to hold internal files taken from the organisation.
The incident is one of many similar listings reported that year, yet few technical details have been made public. The number of people affected remains unknown, and no confirmation of the data’s contents or subsequent distribution has been released by Lonrho or independent investigators.
Breaking down the breach
The only confirmed public information is the listing itself. Avaddon placed Lonrho on its leak site on 9 September 2021 and stated that internal files had been exfiltrated during a ransomware operation. No file counts, sample data, or ransom demands have been disclosed in open sources. The organisation has not published a statement confirming or denying the claims, and the scale of any encryption or data loss is not publicly documented.
Inside avaddon
Avaddon operated as a ransomware-as-a-service group that combined file encryption with the threat of data publication. The group maintained a leak site where it listed organisations it claimed to have compromised, a method intended to increase pressure on victims who refused to pay. Avaddon was active through 2020 and 2021 before its infrastructure was disrupted by law-enforcement action in 2022. Its listings typically included corporate or institutional targets and asserted that sensitive internal material had been removed prior to encryption.
Who is Lonrho?
Lonrho is a diversified investment and operating company with long-standing interests across sub-Saharan Africa. Its activities have historically spanned mining, agriculture, logistics and infrastructure. Organisations of this type routinely hold commercial contracts, operational records, financial information and communications with government and business partners. A breach affecting such records can expose strategic and financial details even when no consumer data is involved.
The information in question
The listing refers only to “internal files.” No inventory of specific data categories has been released. Organisations in Lonrho’s sectors commonly store contracts, project documentation, personnel records and regulatory correspondence. Without an official disclosure or verified sample, the precise nature and volume of any material remain unconfirmed.
Why it matters
Exposure of internal commercial files can create competitive, regulatory and operational risks for the affected organisation and its partners. Even without personal data, leaked contracts or strategic documents may affect negotiations, compliance obligations or relationships with third parties. For individuals whose records appear in such files, the main concern is secondary misuse of any personal details that may have been stored alongside business information.
Were you affected?
Because the incident involves internal corporate files rather than a consumer database, direct personal exposure is difficult to assess from public information. Individuals can still check whether their email address appears in known breach datasets by using a free exposure scanning service. Practical steps include monitoring accounts for unusual activity, using unique passwords with a password manager, and enabling multi-factor authentication on important services. Organisations should follow any official statements Lonrho may issue regarding the incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
JetSJ Listed by avaddon Ransomware GroupSolvere LLC Listed by avaddon Ransomware GroupSL Corporation Listed by avaddon Ransomware GroupMEGAPOLIS HOLDINGS (OVERSEAS) LIMITED Listed by avaddon Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Lonrho Listed by avaddon Ransomware Group →
Publicly posted by avaddon — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.