securens.in Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations that sit at the centre of physical and digital security operations, turning the very systems meant to protect people and property into potential sources of exposure. In late March 2023, the Indian security-services firm securens.in appeared on a leak site operated by the LockBit3 ransomware group, adding another name to a long list of companies whose internal material has been claimed as stolen.

Public detail remains limited. What is known is that the group listed the organisation and asserted that internal files had been taken in a ransomware attack. The number of people affected has not been disclosed, and independent confirmation of the full scope is not available in the public record. For customers, partners and employees of a firm that specialises in surveillance and monitoring, even an unverified claim warrants careful attention.

What happened

On or around 24 March 2023, securens.in was listed by the LockBit3 ransomware group. According to the reported summary, the listing stated that internal files had been exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of individuals affected, or the precise date the intrusion began. The method of initial access, the duration of any dwell time inside the network, and whether a ransom demand was paid or refused have not been disclosed in available reporting. The incident is therefore known primarily through the group’s own claim on its leak site rather than through a detailed victim statement or independent forensic disclosure.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has been active for several years under successive versions of the LockBit name. The group typically operates a ransomware-as-a-service model, in which affiliates gain access to victim networks, deploy the encryptor, and share proceeds with the core developers. Its standard playbook includes data theft before encryption, followed by threats to publish the stolen material on a dedicated leak site if payment is not made. LockBit3 has claimed responsibility for attacks across many sectors and geographies; listings on its site are assertions by the group and are not automatically verified by outside parties. In this case, the appearance of securens.in constitutes such a claim. No additional statements attributed specifically to LockBit3 about this victim beyond the listing and the assertion of internal-file exfiltration are part of the public facts provided.

securens.in and its sector

Securens.in is described as a provider of security surveillance systems, safety services and in-camera audit capabilities. Its offerings have included alarm-monitoring services, perimeter intrusion detection, virtual guard patrol via cameras, and tools intended to detect personal-protective-equipment non-compliance, among other monitoring functions. Organisations of this type typically serve commercial and industrial clients that require continuous oversight of physical sites, workforce safety and incident response. Because the business sits at the intersection of physical security and digital infrastructure, it commonly holds network diagrams, camera configurations, client contact details, operational procedures and, in many cases, recorded or live video feeds and associated metadata. A breach affecting such a firm is consequential not only for the company itself but for the brands and facilities that rely on its monitoring services; disruption or exposure can affect both the integrity of security operations and the confidentiality of information about protected sites and personnel.

What was likely exposed

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of data types—such as customer lists, employee records, video archives, credentials or financial documents—has been publicly named. Organisations that supply surveillance and alarm-monitoring services ordinarily maintain technical documentation, client contracts, system credentials, incident logs and, frequently, personally identifiable information belonging to staff and to contacts at client sites. Whether any of those categories were among the files taken in this incident remains unconfirmed. Readers should treat the precise contents as undisclosed pending any fuller statement from the organisation or from independent investigators.

Why it matters

For individuals whose details may have been stored in the company’s systems—employees, client-site contacts, or others—the practical risks include targeted phishing, social-engineering attempts that reference genuine operational details, and potential misuse of any credentials or personal data that were present. For the organisation and its clients, exposure of internal files can reveal security architectures, response playbooks or site-specific weaknesses that adversaries could later exploit. Even when encryption is the most visible effect of a ransomware incident, the prior theft of data creates a longer-lived confidentiality problem. Because the number of people affected is unknown and the exact data types beyond “internal files” are not itemised, the scale of downstream harm cannot be quantified from public information alone; the prudent assumption is that anyone with a past or present relationship to the firm should remain alert to unusual communications and account activity.

What to do if you're exposed

If you believe you may have been connected to securens.in as an employee, contractor or client contact, begin by treating unsolicited messages that reference the company or its services with caution. Change passwords on any accounts that may have shared credentials or recovery information with work systems, and enable multi-factor authentication where it is available. Monitor financial and email accounts for signs of misuse. Keep records of any suspicious contact. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a check is a simple first step toward understanding whether your information has circulated beyond this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.