rajawali.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large holding companies and diversified conglomerates, using data theft and public leak-site listings as leverage. In this environment, even limited public reports of an incident can leave employees, partners and customers uncertain about what may have been exposed. On 13 February 2024, the domain rajawali.com was listed by the LockBit3 ransomware group, which claimed that internal files had been exfiltrated. The number of people affected remains unknown, and further technical detail has not been made public. The listing itself is a claim by the group rather than an independently confirmed disclosure; still, it is enough to warrant careful attention from anyone connected to the organisation.

What follows is a factual account of the reported incident, the actor involved, the nature of the organisation, the limited information available about the data at risk, the practical consequences, and the steps people can take if they believe they may have been exposed.

Inside the incident

Public reporting states that rajawali.com was listed by the LockBit3 ransomware group on 13 February 2024. According to the available summary, the group claimed that internal files had been exfiltrated in a ransomware attack. No further Reported Details have been released about the precise timing of any intrusion, the initial access method, the volume of data taken, or whether encryption was also deployed. The number of people affected is listed as unknown. Because the primary source of the claim is the group’s own leak-site listing, the incident should be treated as an unverified assertion until the organisation or independent investigators provide additional confirmation. At present, the public record consists only of the listing date, the attribution to LockBit3, and the description of internal files as the material said to have been removed.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has operated for several years under the broader LockBit banner. The group is known for a ransomware-as-a-service model in which affiliates conduct intrusions and share proceeds with the core operators. Its typical tactics include double extortion: after gaining access, operators or affiliates steal data and then threaten to publish it on a dedicated leak site if a ransom is not paid. LockBit has historically listed a wide range of organisations across many countries and sectors, often posting sample files or directory listings to pressure victims. Public knowledge of the group’s methods does not, however, confirm any specific technical claim about this particular listing. The appearance of rajawali.com on the LockBit3 site is therefore best understood as the group’s assertion that it holds data belonging to the organisation, not as independently verified proof of the full scope or success of an attack.

About rajawali.com

Rajawali Group is described as an Indonesia-based national investment holding company with operations spanning multiple industries. These include plantation and mining interests, hotel and property assets associated with international brands such as Sheraton, Luxury Collection, St Regis and Four Seasons, as well as infrastructure and transportation activities that include Express Taxi. Holding companies of this type typically manage corporate records, financial information, contracts, employee data and operational documents across their subsidiaries. A reported breach affecting such an organisation is consequential because the data held can touch employees, business partners, suppliers and, indirectly, customers of the various operating companies. Even when the exact contents of any stolen material remain unconfirmed, the breadth of the group’s activities means that a successful data theft could have wide secondary effects.

What data was at risk

The only data type named in the public report is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of file categories, no count of records, and no confirmation of personal identifiers, financial details or customer information have been released. Organisations of this kind commonly hold employee personnel files, payroll and benefits data, vendor contracts, board and financial documents, operational reports from subsidiaries, and correspondence related to property, mining, plantation and transport businesses. Because the precise contents remain undisclosed, it is not possible to state as fact which of these categories, if any, were among the material claimed by LockBit3. Readers should treat any specific assertion about the nature of the files as unconfirmed until further official information appears.

The real-world impact

For individuals, the principal risk is that personal or professional information contained in internal files could later be used for phishing, social-engineering attempts, identity fraud or targeted outreach. Employees and contractors may face increased scrutiny of unsolicited messages that reference internal projects or colleagues. Business partners and suppliers could see commercial details surface in ways that affect negotiations or competitive position. For the organisation itself, the listing creates reputational pressure, potential regulatory scrutiny under Indonesian data-protection expectations, and the operational cost of investigating and containing any confirmed intrusion. Because the number of people affected is unknown and the exact data types remain unconfirmed, the scale of these risks cannot yet be quantified; the prudent response is to assume that sensitive internal material may have left the organisation’s control and to act accordingly.

What to do if you're exposed

Anyone who has worked for, contracted with, or supplied services to Rajawali Group or its subsidiaries should treat the reported listing as a reason for heightened caution. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and financial services, and be sceptical of unexpected messages that claim to come from company contacts. Change passwords on any accounts that may have been reused or shared in a work context. Keep records of any suspicious communications. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets; such a check provides an additional early-warning signal while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.