nonson.com.vn Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 13, 2023, the Vietnamese fashion retailer nonson.com.vn was listed by the ransomware group lockbit3. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details of the incident have not been disclosed.

The listing itself is a claim by the group rather than an independently verified confirmation of every asserted detail. For customers, partners, and others who may have dealt with the company, the episode raises ordinary but serious questions about what information left its systems and how that information might later be misused.

What happened

According to the available record, nonson.com.vn appeared on a lockbit3 leak site on or around February 13, 2023. The reported summary describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data taken, the precise date the intrusion began, the initial access method, or whether systems were encrypted in addition to data theft. The number of individuals affected is listed as unknown. Beyond the group’s claim that internal files were removed, further technical and timeline particulars remain undisclosed in the material provided.

The group behind it: lockbit3

Lockbit3 is a well-documented ransomware operation that has appeared repeatedly in public reporting since earlier iterations of the LockBit brand. Groups operating under this name typically run a ransomware-as-a-service model: affiliates gain access to victim networks, exfiltrate data, deploy encryption in many cases, and then threaten to publish stolen material on a dedicated leak site if a ransom is not paid. The double-extortion approach—combining encryption with the threat of data release—has been a consistent feature of their publicly observed activity.

Lockbit3 and its predecessors have been linked to numerous incidents across multiple countries and sectors. Their leak sites function as pressure mechanisms and as public claims of responsibility. In this case, the appearance of nonson.com.vn on such a listing constitutes the group’s assertion that it held and intended to leverage the company’s data. No independent confirmation of the full scope of that claim is contained in the facts at hand, and readers should treat the listing as an unverified claim by the actors themselves.

nonson.com.vn and its sector

nonson.com.vn operates as Non Son Fashion, described in available material as a leading fashion business serving Vietnamese customers. Fashion and apparel retailers commonly maintain e-commerce platforms, customer accounts, order histories, payment-related records, supplier and logistics information, employee data, and internal commercial documents. Even when a company presents itself primarily as a consumer brand, the supporting systems often hold a mix of personal, financial, and operational information.

A breach affecting a retailer in this sector matters because the data such organisations typically process can be reused for fraud, phishing, or competitive harm. Customers may have shared names, contact details, addresses, and purchase information; staff and suppliers may appear in internal files. The consequences therefore extend beyond the company itself to anyone whose details were stored in the affected environment.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, databases, or specific categories of personal information has been disclosed. It is therefore not possible to confirm exactly which records left the organisation’s control.

Organisations of this kind commonly hold customer account and order data, contact and shipping details, employee and payroll-related records, supplier contracts, inventory and pricing information, and internal correspondence. Any or none of these may have been among the exfiltrated files; the precise contents remain unconfirmed. Readers should not assume that particular data elements were or were not included solely on the basis of the public listing.

The real-world impact

For individuals, the principal risks are secondary misuse of any personal information that may have been taken: targeted phishing emails that reference real orders or account details, attempts at identity fraud, or credential stuffing if login data was present. Because the number of people affected is unknown and the exact data types are not itemised, the scale of personal exposure cannot be quantified from public facts alone.

For the organisation, a ransomware incident involving exfiltration typically brings operational disruption, potential regulatory and contractual obligations, reputational damage, and the cost of investigation and remediation. Even without confirmed encryption of production systems, the loss of internal files can impair commercial confidentiality and trust with customers and partners. These effects are concrete but vary widely depending on what was actually taken and how the company responded—details that remain largely undisclosed here.

What to do if you're exposed

If you have been a customer, employee, or partner of nonson.com.vn, treat the incident as a prompt to review your own exposure rather than as proof that your specific records were allegedly stolen. Change passwords on any accounts that reused credentials associated with the company, enable multi-factor authentication where available, and watch for unexpected messages that reference the brand or your past orders. Monitor financial statements for unfamiliar activity and be cautious about unsolicited requests for personal or payment information.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or rule out involvement in this particular incident, but it provides a practical way to see whether your address has surfaced elsewhere and to decide what further precautions to take.

AICompiled with AI assistance from public sources and published under our editorial standards.