spoormaker.co.za Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 19 March 2023, the engineering consultancy spoormaker.co.za appeared on a leak site operated by the ransomware group known as lockbit3. The listing claimed that internal files had been taken in a ransomware attack and that more than 350 GB of confidential data belonging to Spoormaker and Partners Inc. were involved. For clients, partners, and anyone whose details may sit inside those files, the practical question is straightforward: what information could now be outside the organisation’s control, and what steps make sense in response.

Public reporting does not yet confirm how many people are affected or precisely which records were copied. What is known comes largely from the group’s own claim and from the limited description attached to the listing. That uncertainty itself is part of the stakes: without clear notification, individuals and counterparties must decide how to protect themselves on incomplete information.

Breaking down the breach

According to the available record, spoormaker.co.za was listed by lockbit3 on 19 March 2023. The organisation is identified as Spoormaker and Partners Inc., with CIPC registration number 1981/008290/21. The group’s summary describes the firm’s work as consultations on mechanics, electrics, fire fighting and sanitation, together with designing. It further asserts that more than 350 GB of confidential data were obtained.

The facts state that internal files were exfiltrated in a ransomware attack. Beyond that characterisation, timing of the intrusion, the initial access method, whether encryption was also deployed, and any negotiation or payment details remain undisclosed. The number of people affected is recorded as unknown. No independent confirmation of the volume or contents of the claimed data set has been supplied in the material available for this account; the 350 GB figure and the description of the material as confidential are presented as claims made in the listing.

Inside lockbit3

Lockbit3 is a well-documented ransomware operation that has functioned as a ransomware-as-a-service platform. Affiliates gain access to victim networks, deploy the group’s encryptor, and commonly exfiltrate data before encryption so that the operators can threaten public release if a ransom is not paid. The group maintains a leak site on which it names organisations and, in many cases, publishes samples or larger archives when deadlines pass.

Public reporting over several years has associated lockbit3 with attacks across multiple sectors and countries. Its typical pattern includes double extortion—combining operational disruption with the leverage of stolen data—and the use of the leak site both to pressure victims and to advertise successful operations to other criminals. In this incident, the appearance of spoormaker.co.za on that site constitutes the group’s claim that it holds the firm’s data; it does not, by itself, constitute independent verification of every detail in the listing.

spoormaker.co.za and its sector

Spoormaker and Partners Inc. is a South African professional services firm whose public description centres on engineering consultations covering mechanics, electrics, fire fighting and sanitation, as well as design work. Firms of this type routinely handle project documentation, technical drawings, correspondence with clients and contractors, and administrative records necessary to deliver regulated building and infrastructure services.

A breach affecting such an organisation is consequential because the data it holds often relates not only to the firm itself but to third parties—property owners, developers, municipalities, and other consultants—whose projects depend on accurate, confidential technical information. Exposure can affect commercial negotiations, regulatory compliance, and the security of physical systems described in the files. The CIPC registration detail underscores that the entity is a long-established incorporated practice, increasing the likelihood that its archives span many years of client work.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack and record the group’s claim of more than 350 GB of confidential data. No further breakdown—such as employee records, client personal data, financial documents, or specific project files—is provided in the available record. Exact contents therefore remain unconfirmed.

Organisations performing mechanical, electrical, fire-protection and sanitation design typically retain drawings, specifications, calculation sets, site reports, contracts, invoices, and internal email. They may also hold identity and contact details for staff and clients, and sometimes access credentials or network documentation used in project delivery. Whether any of those categories were present in the claimed archive cannot be established from the public facts; readers should treat the precise inventory as unknown until the organisation or a competent authority provides verified notice.

What's at stake

For individuals whose information may have been included, the concrete risks include unwanted contact, phishing that references real projects or colleagues, and, if identity documents or financial details were stored, attempts at fraud. For corporate clients and partners, released technical files could expose commercially sensitive designs, pricing, or security-related building systems, creating competitive or physical-security concerns. The organisation itself faces operational disruption, potential regulatory scrutiny under data-protection rules, and the cost of investigation and remediation.

Because the scale of personal data involvement is unknown, the prudent assumption for anyone who has dealt with the firm is that some residual risk exists until clearer information emerges. Sensational claims about inevitable identity theft or catastrophic system compromise are not supported by the limited facts; the realistic picture is one of elevated vigilance rather than confirmed widespread harm.

Were you affected?

If you have been a client, employee, or supplier of Spoormaker and Partners Inc., monitor account statements and email for unexpected messages that reference the firm or its projects. Enable multi-factor authentication on important accounts, and treat unsolicited requests for credentials or payments with caution. Consider placing fraud alerts with relevant credit bureaux if you believe identity documents may have been held. Official notification from the organisation, if and when it arrives, should take precedence over third-party claims.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical baseline for further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.