rbauction.com Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 11, 2021, the domain rbauction.com appeared on a leak site operated by the LockBit2 ransomware group. The listing stated that internal files had been taken during a ransomware operation, though the number of people affected and the precise contents of any data remain undisclosed in public reporting. The incident matters because rbauction.com processes transactions and account information for users of an industrial auction platform. Even without Reported Details on the scale or type of records involved, any exposure of internal material from such a service can affect individuals and businesses that rely on it for equipment purchases and sales.

What happened

Public records show only that rbauction.com was listed on the LockBit2 leak site on December 11, 2021. The group claims to have stolen internal data, but no independent confirmation of the volume, encryption status, or subsequent release of files has been reported. The number of individuals or entities whose information may be involved is not publicly stated.

Inside lockbit2

LockBit2 is a ransomware operation that has conducted multiple campaigns since at least 2020. The group typically gains initial access through phishing or exploited remote services, then deploys encryption while also copying selected files. It maintains a public leak site where it lists victims and threatens to publish stolen material if ransom demands are not met. Earlier activity by the same operators has targeted organisations across manufacturing, logistics, and professional services.

About rbauction.com

rbauction.com is the online platform of Ritchie Bros. Auctioneers, a company that conducts auctions of heavy equipment, trucks, and industrial assets. The service handles bidder registrations, payment processing, and shipment coordination for participants worldwide. Organisations of this type routinely collect names, addresses, financial details, and transaction histories in the course of normal operations.

What was likely exposed

The only detail released is that internal files were allegedly exfiltrated. No inventory of specific data categories has been published by either the organisation or the group. Companies in the auction and equipment-sales sector commonly store customer account records, payment card information, and internal correspondence, but the exact contents of the claimed exfiltration remain unconfirmed.

What's at stake

Individuals whose records appear in any exposed files could face risks of account takeover or targeted fraud if login credentials or payment details are present. For the organisation, the incident adds operational costs for investigation and potential regulatory notification. Without verified data on what was taken, the full scope of downstream effects cannot yet be measured.

Were you affected?

Check whether your email address appears in known breach datasets through a free exposure scan. If you have an account with rbauction.com or have bid at its auctions, review statements from the company for any further updates and consider these immediate steps:

• Change passwords for the affected account and any reused elsewhere.
• Enable multi-factor authentication on financial and email accounts.
• Monitor bank and credit-card statements for unauthorised activity.
• Place a fraud alert with a major credit bureau if personal identifiers were likely involved.

AICompiled with AI assistance from public sources and published under our editorial standards.