securicon.co.za Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a security firm appears on a ransomware group's leak site, the people who may be affected are not only the company's own staff. Clients who rely on guarding, alarm monitoring and risk management can find that operational details, contact records or site information have been swept up in the same incident. Public reporting does not yet say how many individuals are involved or exactly which records left the network, so the practical stakes remain uncertain but real for anyone whose details sit inside a security provider's systems.

On 8 October 2023, securicon.co.za was listed by the LockBit3 ransomware group. The listing asserts that internal files were taken in a ransomware attack. Beyond that claim and a brief description of the firm's regional security work, confirmed detail is limited. What follows sets out what is known, what remains undisclosed, and what people can usefully do next.

What happened

Public records state that securicon.co.za was listed by LockBit3 on 8 October 2023. The available summary describes the organisation as Securicon Lowveld, a provider of professional security services focused on risk management, experienced guarding, and alarm monitoring and response, with its main focus in the Nkomazi Onderberg region. The breach record characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated.

The number of people affected is unknown. No public figure has been given for the volume of data, the precise date the intrusion began, or the technical method used to gain access. Whether any ransom demand was paid, whether systems were encrypted as well as copied, and whether the organisation has issued its own confirmation are all undisclosed in the material available for this account. The listing itself is a claim by the threat actor; independent verification of the full scope has not been supplied in the reported facts.

The group behind it: lockbit3

LockBit3 is a well-documented ransomware operation that has appeared repeatedly in public breach reporting. Groups operating under the LockBit name have typically used a ransomware-as-a-service model: affiliates gain access to networks, deploy encryption malware, and exfiltrate data before posting victims on a dedicated leak site if payment is not made. The pressure tactic is straightforward—threaten to publish stolen files unless a ransom is paid—and the group has historically claimed responsibility for attacks across many countries and sectors.

In this case, LockBit3's leak-site listing is the source of the attribution. The group claims that internal files belonging to securicon.co.za were taken. No further statements from the group about this specific victim—such as sample file lists, employee counts, or ransom amounts—are included in the facts provided here, and none should be assumed. LockBit's broader history of double-extortion tactics is public knowledge; any assertion that those tactics were fully carried out against this organisation beyond the exfiltration claim remains tied to the actor's own listing.

securicon.co.za and its sector

Securicon Lowveld, operating as securicon.co.za, provides physical and operational security services. According to the reported summary, its work centres on risk management, guarding, and alarm monitoring and response in the Nkomazi Onderberg region. Firms in this sector routinely hold information needed to protect client sites: contact lists for key holders and response teams, schedules, site layouts or access procedures, incident logs, and internal administrative records about staff and contractors.

A breach at a security provider is consequential because the organisation's role is to reduce risk for others. If internal files are copied, the exposure can touch both the company's own workforce and the clients who depend on its monitoring and guarding. Even when the exact contents of a theft are unconfirmed, the sector's typical data holdings mean that operational and personal information can be intertwined. That combination raises the potential impact beyond a purely administrative leak.

The information in question

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of customer, employee or financial data have been published in the available report. It is therefore not possible to state as fact which specific categories of information left the organisation.

Organisations that supply guarding, alarm response and risk management commonly store staff identity and contact details, client site information, monitoring logs, contracts and internal correspondence. Those are the kinds of records that could, in principle, appear among "internal files." Until a fuller disclosure is made by the organisation or by independent investigators, however, the exact contents remain unconfirmed. Readers should treat any more detailed description circulating without primary sourcing as unverified.

What's at stake

For individuals, the concrete risks depend on what was actually taken. If staff or client contact details were included, phishing and social-engineering attempts become more plausible because attackers can reference real names, roles or locations. If operational documents such as response procedures or site-related notes were among the files, that information could in theory be misused by people seeking to bypass physical security—though there is no public confirmation that such documents were present. Identity fraud and credential stuffing are longer-term concerns whenever personal data appears in breach collections, but again the facts do not establish that personal identity documents were part of this incident.

For the organisation, the stakes include disruption to monitoring and guarding services, loss of client confidence, and the cost of investigation and recovery. A ransomware event can also expose gaps in backup readiness and access control that require sustained remediation. None of this establishes negligence as a proven fact; it simply describes the ordinary consequences that follow when a security provider's internal files are claimed to have been stolen.

If your data was in this claimed breach

If you are a client, employee or contractor of Securicon Lowveld or securicon.co.za, treat the situation as a prompt to tighten routine defences rather than as confirmed proof that your personal file was taken. Change passwords on accounts that may have been used in connection with the firm, especially if those passwords were reused elsewhere. Enable multi-factor authentication wherever it is offered. Watch for unexpected emails, calls or messages that reference security services, alarms or site access—these can be crafted from scraps of real internal information. Consider a credit or identity-monitoring check if you have reason to believe identity documents or financial details were held by the company, while recognising that the public record does not confirm those data types.

You can also run a free exposure scan of your email address to see whether it has already appeared in known breach datasets. That check will not prove or disprove involvement in this specific incident, but it can show whether your address is circulating more widely and help you prioritise further password and account hygiene. Stay alert to any official notice from the organisation itself; until clearer inventories are published, measured caution is the most reliable response.

AICompiled with AI assistance from public sources and published under our editorial standards.