rehub.ie Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 9 May 2024, the website rehub.ie was listed by the ransomware group known as lockbit3. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and further technical details have not been disclosed. The organisation behind the site is associated with Rehab Group, an Irish charity that works with people who have disabilities or additional support needs.

Because the listing comes from a ransomware group's leak site, it constitutes a claim rather than independently verified confirmation of every asserted detail. What is known so far is limited to the fact of the listing, the reported date, and the description of internal files having been taken. For individuals connected to the charity—service users, families, staff or donors—the incident raises practical questions about what information may now be outside the organisation's control.

Breaking down the breach

According to available records, rehub.ie appeared on lockbit3's listings on 9 May 2024. The reported summary characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data, the precise date the intrusion began, the initial access method, or whether systems were also encrypted. The number of people affected is listed as unknown.

Ransomware incidents of this type typically involve unauthorised access followed by data theft and, often, a demand for payment under threat of publication. In this case the public record stops at the leak-site listing and the statement that internal files were taken. No independent confirmation of the full scope, the exact contents of those files, or any subsequent publication has been supplied in the source material. Timing beyond the 9 May 2024 reporting date, scale, and technical method therefore remain undisclosed.

Who is lockbit3?

Lockbit3 is a well-documented ransomware operation that has been active for several years under the broader LockBit banner. The group operates a ransomware-as-a-service model in which affiliates carry out intrusions and share proceeds with the core developers. Its typical tactics include double extortion: data is stolen before encryption, and the group threatens to publish the material on a dedicated leak site if a ransom is not paid.

LockBit has claimed responsibility for attacks against organisations across many sectors and countries. The group maintains a public-facing blog and leak site where it posts victim names, sample files and, in some cases, full archives. Listings on that site are claims made by the group itself; they are not automatically verified by independent investigators or by the named organisations. In the present matter, lockbit3's listing of rehub.ie should be treated as such a claim pending any further corroboration.

Who is rehub.ie?

rehub.ie is the online presence linked to Rehab Group, an Irish charity that describes itself as championing diversity and inclusion for people with a disability or with additional support needs in their communities. Charities of this kind typically deliver residential, day, employment and community-based services. They hold records relating to service users, their families or carers, staff, volunteers, donors and partner organisations.

Because the organisation works with a population that may include vulnerable adults and children, the data it processes often carries heightened sensitivity. A breach affecting such an entity is consequential not only for operational continuity but also for the privacy and safety of the people who rely on its services. Public detail about the precise relationship between the rehub.ie domain and Rehab Group's wider IT estate is limited, yet the association is clear from the available reporting.

What was likely exposed

The source material states that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, databases or categories of personal information has been disclosed. Organisations that provide disability and support services commonly hold names, contact details, medical or care-related notes, financial records, employment data and correspondence. Whether any of those categories were among the internal files taken in this incident is unconfirmed.

It is therefore not possible to state as fact that specific personal data fields were exposed. The only confirmed description remains “internal files.” Readers should treat any more granular claims circulating online as unverified unless and until the organisation or an independent authority publishes additional detail.

What's at stake

For individuals whose information may have been among the exfiltrated files, the practical risks include unwanted contact, identity misuse, or the exposure of sensitive personal circumstances. People who receive support services may face particular distress if care-related or medical details become public. Staff and donors could encounter phishing attempts that leverage internal knowledge of the organisation.

For Rehab Group itself, the incident carries operational, reputational and regulatory consequences. Restoring systems, investigating the intrusion, notifying regulators and supporting affected people all require resources. Because the number of people affected is unknown and the exact data types remain undisclosed, the full extent of those consequences cannot yet be measured. The absence of confirmed figures does not reduce the need for careful handling of any subsequent notifications or support measures.

Were you affected?

If you have a connection to rehub.ie or Rehab Group—as a service user, family member, employee, volunteer or donor—consider the following steps. Monitor official communications from the organisation for any notification or advice. Be alert to unexpected emails, calls or messages that reference the charity or request personal or financial information. Review bank and credit statements for unusual activity and consider placing fraud alerts if you believe sensitive identifiers may have been involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check will not confirm or rule out involvement in this specific incident, but it can indicate whether your address has surfaced elsewhere and help you prioritise further protective measures. Keep records of any correspondence you receive about the breach and follow guidance issued by the organisation or by Irish data-protection authorities as it becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.