the3rivers.net Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target education providers as part of a broader pattern in which schools and multi-academy trusts are listed on leak sites after claimed data theft. In this climate, even limited public details about an incident can leave staff, families and local communities uncertain about what may have been taken and what steps to take next.

On 21 March 2023, the3rivers.net was listed by the LockBit3 ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical detail has not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope is not part of the available record.

Breaking down the breach

According to the reported facts, the3rivers.net appeared on a LockBit3 listing dated 21 March 2023. The organisation is identified with the Three Rivers Learning Trust. The only data description given is that internal files were allegedly exfiltrated in a ransomware attack. No figure for individuals affected has been published, no attack vector or initial access method has been detailed in the public summary, and no timeline of compromise, encryption, or negotiation has been released. Because those elements are undisclosed, the precise sequence of events and the volume of material involved cannot be stated from the available record.

What is known is therefore narrow: a claim of ransomware-related exfiltration of internal files, attributed to LockBit3 via its leak-site listing, reported on that date. Anything beyond that—specific systems hit, duration of access, or confirmation of what was later published—remains unconfirmed in the facts provided.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has operated as a ransomware-as-a-service model, in which affiliates conduct intrusions and deploy the group’s encryptor and leak infrastructure. Public reporting on the group over several years has described double-extortion tactics: data is stolen before systems are encrypted, and victims are threatened with publication on a dedicated leak site if a ransom is not paid. The group has been associated with attacks across many sectors, including education, healthcare, and manufacturing, and has used high-volume affiliate activity and automated leak-site processes to pressure organisations.

In this case, the facts state only that the3rivers.net was listed by LockBit3 and that internal files were described as exfiltrated. No victim-specific statements, ransom demands, or sample file listings from the group about this organisation are included in the given record. The leak-site appearance should therefore be treated as the group’s claim rather than as independently verified detail about every file or system involved.

Who is the3rivers.net?

Public information associated with the incident identifies the3rivers.net with the Three Rivers Learning Trust. The trust was established in 2011 and consists of eight schools. These schools have a long history of providing education services to the local population. Multi-school trusts of this kind typically manage shared administrative systems, pupil and staff records, finance and procurement data, and communications platforms that support day-to-day school operations.

A breach claim against such an organisation matters because education providers hold information about children, parents or guardians, teachers and support staff, and often contractors or local partners. Even when the exact contents of a theft are not confirmed, the sector’s reliance on digital records for safeguarding, attendance, special educational needs, and payroll means that unauthorised access can create lasting concern for the communities the schools serve.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No further breakdown—such as pupil data, staff HR files, financial documents, or email archives—is provided. The number of people affected is unknown.

Organisations of this type commonly hold student and parent contact details, safeguarding and pastoral notes, staff employment and payroll information, governance documents, and operational records. It is reasonable to note that those categories are typical for a multi-school trust; it is not established fact that any specific category was present in the material LockBit3 claims to have taken. Exact contents remain unconfirmed.

The real-world impact

For individuals, the practical risks depend on what was actually in the exfiltrated files. If personal data were included, possible consequences include unwanted contact, phishing that impersonates the school or trust, or misuse of identity details over time. Children and families may face particular sensitivity around any pastoral or medical-related information, though again the facts do not confirm such content. Staff could face risks around employment or financial data if those records were among the internal files.

For the trust, a ransomware incident and public listing can disrupt teaching and administration, divert resources to incident response and recovery, and damage confidence among parents and staff. Even without a confirmed count of affected people, the combination of claimed data theft and the education sector’s duty of care creates a need for clear communication and careful monitoring for secondary fraud or social-engineering attempts that reference the schools.

What to do if you're exposed

If you are a parent, pupil (or former pupil of appropriate age), staff member, or partner of the Three Rivers Learning Trust schools and are concerned you may be affected, treat unsolicited messages that reference the schools with caution. Prefer official channels published by the trust when checking for updates. Consider placing fraud alerts or credit monitoring where appropriate in your jurisdiction, and change passwords on accounts that may have been reused or linked to school email. Keep copies of any suspicious correspondence.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm involvement in this specific incident, but it can help you prioritise further password changes and monitoring if your address has surfaced elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.