Loozap Listed by lapsus$ Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What happened

Public reporting on the incident is limited to the group’s listing of Loozap. No statement from the company has been referenced in available records, and no timeline for the intrusion, volume of data, or method of access has been released. The scale of the operation and whether any data was subsequently published remain unconfirmed.

The group behind it: lapsus$

Lapsus$ is a publicly documented threat actor that has previously claimed responsibility for intrusions at multiple large organizations. Its operations have typically involved social-engineering techniques and the exfiltration of internal material, followed by listings on dedicated leak sites. In this case the group claims to have obtained material from Loozap, but independent confirmation of the claim or of any subsequent publication has not been reported.

Loozap and its sector

Loozap operates an online marketplace that connects buyers and sellers of second-hand goods across several African countries, including Ghana and Kenya. The platform lists vehicles, property, electronics, furniture and clothing. Marketplaces of this type routinely process user accounts, transaction records and communications between parties, making them repositories of personal and commercial information.

The information in question

The only detail released is that internal files were taken. No inventory of specific data categories has been published, and the exact contents of the exfiltrated material are therefore unconfirmed. Organizations in this sector commonly hold account credentials, contact details, transaction histories and item listings, but whether any of these were among the files cannot be verified from current public information.

The real-world impact

Exposure of internal files can create downstream risks for individuals whose records appear in those files, including potential misuse of contact information or account credentials. For the company, the incident adds operational and reputational consequences typical of ransomware listings, though the precise business effects remain undisclosed. The absence of a confirmed victim count limits any assessment of overall reach.

What to do if you're exposed

Individuals concerned about possible exposure should change passwords for any accounts linked to the platform and enable multi-factor authentication where available. Monitoring financial and email accounts for unusual activity provides a practical next step. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public records.

AICompiled with AI assistance from public sources and published under our editorial standards.