lstaff.com / atworksprofessional / atworks.com Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The lstaff.com / atworksprofessional / atworks.com Listed by revil Ransomware Group (reported September 9, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
On September 9, 2021, the organization operating as lstaff.com, atworksprofessional, and atworks.com appeared on a leak site maintained by the revil ransomware group. The listing indicated that internal files had been removed during a ransomware operation, though the number of individuals affected and the precise contents of the material remain undisclosed.
The incident is one of many in which organizations were publicly referenced on ransomware leak sites that year. Public records do not yet confirm whether the data was later released, sold, or used in further attacks.
Inside the incident
The only confirmed detail is the September 9, 2021 listing on the revil site. The group stated that internal files had been taken. No information has been made public about the date of the intrusion itself, the method of initial access, the volume of data removed, or whether encryption was also deployed against the organization’s systems. The number of people whose information may be involved is listed as unknown.
Inside revil
Revil operated as a ransomware-as-a-service group, supplying encryption tools and leak infrastructure to affiliate operators in exchange for a share of ransom payments. The group’s public activity included the publication of stolen files when victims declined to pay. Its infrastructure was disrupted by coordinated law-enforcement action in 2021, after which the core brand largely disappeared from active use, though related code and tactics have appeared under other names.
Who is lstaff.com / atworksprofessional / atworks.com?
The names point to a staffing or professional-services firm that places workers with client organizations and manages related employment records. Companies in this sector routinely hold personal details of applicants and placed employees, along with contracts and communications involving client businesses. A compromise at such a firm can therefore expose information belonging both to individuals seeking work and to the organizations that hire through the service.
What data was at risk
The listing referred only to “internal files.” No inventory of specific data categories has been released by the organization or independently verified. Staffing firms commonly maintain records that include names, contact details, employment history, tax documents, and client correspondence, but it is not confirmed whether any of these categories were among the exfiltrated material in this case.
Why it matters
Even without a confirmed count of affected individuals, the exposure of internal files from a staffing intermediary can create downstream risks for both workers and client employers. Personal identifiers and employment records can be used for identity-related fraud or targeted scams. Client organizations may face secondary exposure if their own project details or contact lists were included in the material.
If your data was in this claimed breach
Begin by monitoring accounts for unusual login attempts and enabling multi-factor authentication wherever available. Request a copy of your employment or placement file from the organization to understand what information it holds. Individuals can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
PTT Exploration and Production - 720GB Listed by revil Ransomware GroupRonmor Holdings Listed by revil Ransomware GroupIaffaldano, Shaw & Young LLP Listed by revil Ransomware GroupAllen, Dyer, Doppelt, & Gilchrist, P.A. Listed by revil Ransomware GroupLatest breaches
Publicly posted by revil — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.