thorntontomasetti.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 02, 2022, thorntontomasetti.com appeared on the leak site operated by the lockbit3 ransomware group. The group claims to have stolen internal data in a ransomware attack that involved the exfiltration of internal files. The number of people affected remains unknown, and public detail on the incident is limited to this listing and the group's assertion.

For an organisation that handles complex engineering and project information, any confirmed or claimed exposure of internal files raises practical questions about what may have left its systems and who might be affected. At present, those questions rest on the group's unverified claim rather than independent confirmation of the full scope.

Inside the incident

Public reporting states that thorntontomasetti.com was listed on the lockbit3 ransomware leak site on or around December 02, 2022. According to the available summary, the group claims to have stolen internal data and describes the material as internal files exfiltrated in a ransomware attack. No further verified particulars have been released in the record: the precise date of initial access, the method of entry, the volume of data taken, or any ransom demand remain undisclosed. The number of individuals whose information may have been involved is unknown. The listing itself constitutes the group's claim; it has not been independently corroborated in the facts provided.

Ransomware incidents of this type typically involve encryption of systems combined with data theft, after which operators threaten to publish the stolen material if their demands are not met. In this case, only the leak-site listing and the assertion of exfiltrated internal files are documented. No additional technical indicators, timelines, or confirmation of publication have been supplied in the public record summarised here.

Inside lockbit3

Lockbit3 is a well-documented ransomware operation that has functioned as a ransomware-as-a-service enterprise. Affiliates gain access to victim networks, deploy the encryptor, and exfiltrate data before issuing demands. The group maintains a dark-web leak site on which it names organisations and, in many cases, posts samples or larger volumes of stolen files when negotiations stall or fail. Its operators have historically targeted a wide range of sectors, using double-extortion tactics that combine system disruption with the threat of public data release.

The group's model relies on speed, automation, and a network of affiliates who share in proceeds. Public reporting over successive years has linked LockBit variants, including LockBit 3.0, to numerous high-profile incidents across engineering, manufacturing, professional services, and other industries. When lockbit3 lists a victim, the listing is a claim by the group that it possesses data and may release it; such claims are not automatically proof of the full extent of compromise. In the present matter, the facts state only that thorntontomasetti.com was listed and that the group claims to have stolen internal data. No further statements attributed to the group about this specific victim appear in the record.

thorntontomasetti.com and its sector

Thornton Tomasetti is an international engineering firm known for structural engineering, façade engineering, forensic work, and related technical consulting on buildings, infrastructure, and complex projects. Organisations of this kind routinely manage detailed design files, project documentation, client correspondence, contracts, and internal operational records. They also hold employee information and, depending on the engagement, data tied to owners, contractors, and public or private clients.

A breach affecting such a firm is consequential because the material it holds can include commercially sensitive designs, proprietary methods, and personal or contractual details belonging to staff and third parties. Even when the precise contents of an alleged theft remain unconfirmed, the sector's reliance on trusted handling of technical and personal data means that any credible claim of exfiltration warrants careful attention from those who have worked with or for the organisation.

What data was at risk

The facts name the exposed material only as "internal files exfiltrated in a ransomware attack." No inventory of specific file types, databases, or record categories has been disclosed. The number of people affected is unknown.

Engineering and professional-services firms of this type commonly maintain project archives, CAD and modelling files, email and messaging records, human-resources documents, financial and billing data, and client deliverables. It is reasonable to expect that some combination of these categories could exist within internal systems. However, the exact contents taken in this incident are unconfirmed. No public detail establishes whether employee personal data, client personal data, or purely technical project files formed part of the claimed exfiltration. Readers should treat any assumption about specific data elements as speculative until official notification or further verified reporting appears.

What's at stake

For individuals, the real-world risk depends on whether personal information was among the internal files the group claims to hold. If employee or contractor records were included, possible consequences include targeted phishing, identity-related misuse, or unwanted contact that leverages knowledge of workplace details. If only technical or commercial files were taken, the direct personal risk may be lower, though reputational or contractual ripple effects can still reach people associated with affected projects.

For the organisation, a claimed ransomware incident brings operational disruption, potential regulatory notification duties, client-trust questions, and the cost of investigation and remediation. Because the scale and contents remain undisclosed, the concrete exposure cannot yet be quantified. The absence of confirmed figures does not eliminate risk; it simply means affected parties must proceed on the basis of caution rather than precise inventories.

If your data was in this claimed breach

If you have a past or present relationship with Thornton Tomasetti—as an employee, contractor, client contact, or project participant—treat the lockbit3 claim as a signal to heighten vigilance. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be alert to phishing messages that reference the firm or its projects. If you receive official notification from the organisation, follow the instructions it provides regarding credit monitoring or other protective steps.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step offers a practical baseline while further details, if any, emerge about this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.