merz-elektro.de Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 22, 2023, the German industrial supplier merz-elektro.de was listed by the ransomware group known as lockbit3. Public reporting indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details of the incident have not been disclosed.

The listing itself constitutes a claim by the group rather than independent confirmation of every asserted detail. For customers, partners and employees of an organisation that supplies specialised electrical and metal-working products across national and international markets, the episode raises concrete questions about what data left its systems and what practical steps follow.

What happened

According to the available record, merz-elektro.de appeared on a lockbit3 leak site on or about November 22, 2023. The sole concrete description of the data involved is that internal files were allegedly exfiltrated in the course of a ransomware attack. No public figure has been given for the volume of data, the precise date the intrusion began, the initial access method, or whether any ransom demand was paid or refused. The number of individuals whose information may have been included is listed as unknown. Beyond the fact of the listing and the characterisation of the material as internal files taken during a ransomware incident, further technical and chronological particulars remain undisclosed.

The group behind it: lockbit3

Lockbit3 is a well-documented ransomware operation that has been active for several years in successive versions. Like earlier iterations of the LockBit family, it typically operates as a ransomware-as-a-service model: affiliates gain access to victim networks, deploy the encryptor, and exfiltrate data before encryption in order to apply double-extortion pressure. The group maintains a dark-web leak site on which it names organisations it claims to have compromised and, in many cases, publishes samples or larger archives of stolen data if negotiations stall. Its tactics commonly include exploitation of exposed remote-access services, stolen credentials, or unpatched vulnerabilities, followed by lateral movement and bulk data theft. Lockbit3 has been linked to numerous incidents across manufacturing, professional services and other sectors worldwide. In the present case, the group’s listing of merz-elektro.de is treated as an unverified claim regarding this specific victim; no independent confirmation of every detail asserted on the leak site is contained in the public record summarised here.

Who is merz-elektro.de?

Merz-elektro.de is the online presence of MERZ GMBH, a supplier that provides products to national and international companies in four specialist areas: mobile power distributors, test technology, sheet-metal technology and switching devices. Organisations of this type sit in the industrial-supply and electrical-equipment sector. They routinely hold commercial contracts, technical drawings, customer and supplier contact lists, order histories, pricing information and internal operational documents. Because they serve both domestic and cross-border industrial clients, a compromise can affect not only the company’s own staff but also the procurement and engineering teams of the firms that rely on its components. A ransomware incident at such a supplier therefore carries potential downstream consequences for manufacturing and testing operations that depend on timely delivery and accurate technical data.

The information in question

The public facts state only that internal files were exfiltrated. No inventory of specific document types, file counts or data categories beyond that general description has been released. Companies operating in mobile power distribution, test technology, sheet-metal fabrication and switching devices typically maintain engineering specifications, quality-control records, customer purchase orders, supplier agreements, employee records and internal correspondence. Whether any of those categories were among the files taken in this incident is unconfirmed. Readers should treat the precise contents as unknown until corroborated by the organisation itself or by independent forensic reporting.

What's at stake

For individuals whose details may have been present in internal files—employees, contact persons at customer firms, or suppliers—the principal risks are opportunistic misuse of business contact data, targeted phishing that references genuine commercial relationships, and, if authentication material or personal identifiers were included, downstream account takeover attempts. For MERZ GMBH the stakes include operational disruption during recovery, potential contractual notification obligations to clients, reputational questions among industrial buyers, and the cost of forensic investigation and system hardening. Because the scale of the exfiltration and the exact data types remain undisclosed, the concrete exposure for any single person or partner cannot yet be quantified; the prudent assumption is that any sensitive internal material that resided on the affected systems could have left the organisation’s control.

Were you affected?

If you have done business with MERZ GMBH or merz-elektro.de, or if you are a current or former employee, monitor communications for unexpected requests that reference genuine orders or projects. Change passwords on any accounts that may have shared credentials or been accessible from company systems, and enable multi-factor authentication where it is available. Preserve any suspicious messages for later analysis rather than clicking links or opening attachments. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Direct confirmation of whether your information was involved can come only from the organisation itself once its investigation is complete; until then, treat the scope as unconfirmed and apply standard caution.

AICompiled with AI assistance from public sources and published under our editorial standards.