onyourmark.org Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations that hold sensitive personal and operational records, including those in health, social care and community services. Listings on criminal leak sites have become a common way for such groups to pressure victims and advertise claimed intrusions. Against that backdrop, onyourmark.org was named in a listing attributed to the LockBit3 ransomware operation, with the incident reported on November 20, 2023.

Public detail on the event remains limited. What is known is that the group claimed to have exfiltrated internal files in a ransomware attack. The number of people affected has not been disclosed, and independent confirmation of the full scope has not been made public. For individuals and families connected to disability support services, any such claim warrants careful attention because of the kinds of records these organisations typically maintain.

Inside the incident

According to available reporting, onyourmark.org was listed by the LockBit3 ransomware group on or around November 20, 2023. The reported summary describes the organisation’s mission as providing innovative and comprehensive community-based services to people with intellectual and developmental disabilities across their lifespan. The only data description given in the facts is that internal files were allegedly exfiltrated in a ransomware attack.

No public figure has been released for the number of people affected. Timing of the initial intrusion, the precise method of access, ransom demands, and whether systems were encrypted in addition to data theft are all undisclosed in the material available for this account. The listing itself should be treated as a claim by the threat actor rather than as independently verified proof of every asserted detail. Organisations in this position sometimes confirm, partially confirm, or decline to comment while investigations proceed; none of those outcomes is established here beyond the reported listing and the description of internal-file exfiltration.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has appeared repeatedly in public reporting over recent years. Like earlier iterations associated with the LockBit name, it has typically operated as a ransomware-as-a-service model: core developers provide the malware and leak infrastructure, while affiliates conduct intrusions and share in proceeds. Public analyses of the group’s activity have described double-extortion tactics—encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made.

The group has been linked in open reporting to attacks across many sectors and countries, often favouring organisations whose disruption creates operational or reputational pressure. Leak-site posts commonly include a victim name, countdown timers, and sample files intended to demonstrate access. Those posts are claims by the actors. They do not, by themselves, establish the full accuracy of file counts, the sensitivity of every document, or the current status of negotiations. Law-enforcement actions and infrastructure disruptions have affected LockBit-branded operations at various points, yet listings under the LockBit3 name have continued to appear in public tracking of ransomware activity. Nothing in the facts for this incident attributes specific statements by the group about onyourmark.org beyond the listing and the characterisation of internal files exfiltrated in a ransomware attack.

Who is onyourmark.org?

On Your Mark, reflected in the domain onyourmark.org, is described in the reported summary as an organisation whose mission is to provide innovative and comprehensive community-based services to people with intellectual and developmental disabilities across their lifespan, with a commitment to helping each individual experience the highest quality of life possible within that framing. Organisations of this type typically sit at the intersection of social care, disability support, and community services. They may coordinate day programs, residential or supported-living arrangements, employment supports, family services, and related administrative functions.

Because they work with vulnerable populations over long periods, such organisations ordinarily hold records that go well beyond ordinary customer databases. A breach claim against a provider in this sector is consequential not only for the organisation’s operations and reputation but for the people who rely on its services and for family members or guardians who share information in order to obtain care. Public detail does not establish negligence or specific security failures at onyourmark.org; it establishes only that the organisation was named in a LockBit3-associated listing with a report date of November 20, 2023.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as names, contact details, medical or clinical notes, financial records, staff files, or guardian information—has been disclosed in the material provided. The number of affected individuals is unknown.

Organisations that deliver community-based services to people with intellectual and developmental disabilities commonly maintain intake and assessment records, service plans, contact and emergency information, billing or funding documentation, and correspondence with families and other agencies. Whether any of those categories were among the internal files claimed in this incident is unconfirmed. Readers should not assume a specific inventory of exposed fields; they should treat the contents as undisclosed beyond the general description of internal-file exfiltration.

Why it matters

When internal files from a disability-services provider are claimed to have been stolen, the practical risks are concrete even if the exact file list is unknown. Affected people and their families may face unwanted contact, attempts at social engineering that reference real service relationships, or longer-term concerns about the circulation of personal and health-related information. Staff and contractors can also be exposed if personnel or administrative documents were included.

For the organisation, a ransomware incident—whether or not encryption occurred—can disrupt scheduling, documentation, and continuity of care, and can impose costs related to investigation, notification, and hardening of systems. Because the population served often depends on stable, trusted relationships with providers, any loss of confidence or interruption of services carries weight beyond a typical commercial breach. None of this requires assuming the worst about what was taken; it follows from the nature of the sector and from the simple fact that internal files were reported as exfiltrated while the scale and precise contents remain unknown.

What to do if you're exposed

If you or a family member has a connection to onyourmark.org, treat the situation as a prompt for ordinary vigilance rather than panic. Monitor accounts and mail for unexpected messages that reference services, appointments, or personal details. Be cautious about unsolicited calls or emails asking for verification of identity, payment, or further personal information. If you receive notices from the organisation, follow only the official channels they designate. Consider placing fraud alerts with major credit bureaus if you have reason to believe financial identifiers could have been involved, and keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or deny involvement in this specific incident, but it can help you see whether your address is circulating in broader breach collections and whether additional password or account hygiene is overdue. Stay alert to official updates from the organisation or regulators if more detail becomes public.

AICompiled with AI assistance from public sources and published under our editorial standards.