sirva.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized and enterprise service providers whose systems hold concentrated volumes of corporate and personal data, using leak-site listings as both pressure and publicity. In early October 2023 one such listing named sirva.com, the online presence of Sirva Worldwide, Inc., among victims claimed by the LockBit3 ransomware operation. Public detail remains limited to the group’s own statements and the fact of the listing itself; the number of people affected has not been confirmed.

What is known is that LockBit3 asserted it had exfiltrated a large volume of internal material. For anyone whose employer or household used Sirva’s relocation services, or whose data sat in the company’s systems, the claim raises concrete questions about exposure even while independent verification is still sparse.

What happened

On or about 5 October 2023, the LockBit3 ransomware group listed sirva.com on its leak site. According to the group’s own summary, it had obtained “over 1.5TB of documents” together with “3 full backups of CRM for branches (eu, na and au).” The listing characterises the material as internal files exfiltrated in a ransomware attack. No independent confirmation of the intrusion method, the exact date of access, or the total number of individuals affected has been made public. The scale of any ransom demand, whether negotiations occurred, and whether any data were subsequently released beyond the group’s claim also remain undisclosed.

Who is lockbit3?

LockBit3 is the third major iteration of the LockBit ransomware brand, a long-running ransomware-as-a-service operation that has been active for several years. The group typically gains initial access through compromised credentials, vulnerable remote services or phishing, then deploys encryptors while simultaneously copying data for double-extortion leverage. Victims who do not pay are threatened with publication on a dedicated leak site; the group has listed hundreds of organisations across manufacturing, professional services, healthcare and government supply chains. Its public statements are claims, not verified inventories; security researchers treat leak-site posts as assertions that require corroboration. Nothing in the public record beyond the listing itself confirms the precise contents or authenticity of the material LockBit3 says it holds from Sirva.

sirva.com and its sector

Sirva Worldwide, Inc. supplies relocation and mobility services to corporate human-resources and mobility professionals. The company helps organisations move employees and their families across domestic and international assignments, coordinating housing, logistics, immigration support and related administrative work. Firms in this sector routinely maintain customer-relationship-management systems, employee and assignee records, vendor contracts, financial documents and correspondence that can contain names, contact details, family information, passport or visa data, addresses and corporate account identifiers. Because relocation work sits at the intersection of HR, finance and personal life events, a breach of such systems can affect both the corporate clients and the individual employees being relocated. The listing of sirva.com is therefore consequential for the mobility industry even while the precise scope of any compromise stays unconfirmed.

What was likely exposed

The only data types named in the available record are “internal files exfiltrated in [a] ransomware attack,” with LockBit3 specifically claiming more than 1.5 TB of documents plus three full CRM backups covering European, North American and Australian branches. No further inventory—such as whether the files included Social Security numbers, bank details, medical information or passport scans—has been published by the company or by independent investigators. Organisations that provide corporate relocation services typically hold assignee personal data, family contact information, employment and compensation details, travel and housing records, and internal corporate correspondence. Those categories are what one would expect to find in CRM and document repositories of this kind; whether any of them were in fact present in the claimed 1.5 TB haul remains unconfirmed. The number of people whose records may be involved is likewise unknown.

What's at stake

If the claimed material is authentic and contains personal or financial identifiers, affected individuals face the ordinary risks that follow any large corporate data exposure: targeted phishing that references real relocation details, identity-fraud attempts, and the long-term recirculation of personal data on criminal markets. Corporate clients of Sirva could see proprietary contract terms, pricing or employee lists misused. For the organisation itself, the incident carries operational, legal and reputational costs—notification obligations, potential regulatory scrutiny, and the need to rebuild trust with mobility professionals who rely on the firm to handle sensitive employee moves. Because the exact contents and the number of people affected have not been disclosed, the concrete impact on any single person cannot yet be measured; the risk is real but still bounded by what remains unverified.

Were you affected?

If you or your household used Sirva relocation services, or if your employer is a Sirva client, treat the LockBit3 claim as a prompt to increase vigilance rather than as proof of personal exposure. Monitor financial and credit accounts for unfamiliar activity, be alert to phishing messages that mention relocation or HR details, and consider placing fraud alerts with the major credit bureaus if you believe sensitive identifiers may have been involved. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Official confirmation from Sirva or from regulators, if and when it arrives, will provide the clearest picture of who needs to take further steps.

AICompiled with AI assistance from public sources and published under our editorial standards.