twt.co.za Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 10 January 2024, the South African automotive retailer operating as twt.co.za was listed by the ransomware group known as lockbit3. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical details of the intrusion have not been disclosed.

The listing places the organisation among those whose data the group claims to have taken. For customers, staff and partners of Tiger Wheel & Tyre, the practical question is what information may now be outside the company’s control and what steps can reduce any resulting risk.

Inside the incident

According to the available record, twt.co.za appeared on a lockbit3 leak site on 10 January 2024. The only data description given is that internal files were allegedly exfiltrated in a ransomware attack. No confirmed figure for the volume of data, no list of specific systems compromised, and no public timeline of the intrusion or encryption event have been released. The number of individuals whose information may be involved is recorded as unknown.

Ransomware incidents of this type typically involve unauthorised access, data theft, and a subsequent demand, often accompanied by a threat to publish the material if payment is not made. In this case the public record consists solely of the group’s listing and the statement that internal files were taken. Whether the organisation has confirmed the intrusion, negotiated, or recovered systems is not stated in the available facts. Timing beyond the report date, the precise method of entry, and the full scope of systems affected therefore remain undisclosed.

The group behind it: lockbit3

Lockbit3 is a well-documented ransomware operation that has operated for several years under a ransomware-as-a-service model. Affiliates gain access to networks, exfiltrate data, deploy encryption, and then use dedicated leak sites to pressure victims by threatening or carrying out publication of stolen material. The group has claimed responsibility for attacks across many sectors and countries; its public sites routinely list organisations and, in some cases, sample files or full archives once a deadline passes.

In the present matter the group claims that twt.co.za’s internal files were exfiltrated. That claim originates from the leak-site listing itself and has not been independently verified in the facts supplied. No additional statements attributed to lockbit3 about this specific victim—such as ransom amounts, file counts, or deadlines—are included in the public record used here. Readers should treat the listing as an unverified assertion by the threat actor until corroborated by the organisation or by independent investigation.

About twt.co.za

twt.co.za is the online presence of Tiger Wheel & Tyre, a South African retailer that supplies wheels, tyres, batteries and related fitment services. The company describes itself as part of TiAuto Investments (PTY) Ltd and emphasises expert advice, product range and after-sales service for consumers. Businesses of this kind maintain customer records, vehicle and fitment data, supplier and inventory systems, employee information, and financial or loyalty-programme details as part of ordinary retail and service operations.

A breach involving such an organisation is consequential because the data it holds can link personal identifiers to vehicle ownership, contact details, payment or warranty history, and staff records. Even when the exact contents of an exfiltration remain unconfirmed, the sector’s typical holdings mean that both private individuals and the company itself face potential downstream effects ranging from targeted fraud to operational disruption.

The information in question

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No further breakdown—customer databases, employee records, financial documents, or technical configurations—is provided. Exact contents are therefore unconfirmed.

Organisations in the automotive retail and fitment sector commonly store names, contact details, vehicle registration or VIN information, purchase and service histories, warranty claims, supplier contracts, and internal correspondence. Staff records may include payroll and identity data. Whether any of these categories were among the files taken in this incident is not stated. Until the company or a competent authority publishes a verified inventory, the public record does not establish which specific data types left the organisation’s control.

What's at stake

For individuals, the principal risks are identity misuse, phishing or social-engineering attempts that reference genuine vehicle or purchase details, and possible financial fraud if payment or loyalty data were involved. Even limited internal files can supply enough context for convincing scams. For the organisation, consequences can include regulatory notification duties under South African data-protection law, reputational harm, costs of investigation and remediation, and potential interruption of retail or fitment operations.

Because the scale of the exfiltration and the precise data categories remain unknown, the severity for any given person cannot yet be measured. The prudent stance is to assume that some internal material may be in unauthorised hands and to monitor for unusual activity rather than to treat the incident as either catastrophic or negligible on the basis of incomplete information.

Were you affected?

If you have been a customer, employee or supplier of Tiger Wheel & Tyre, treat the possibility of exposure seriously until more detail emerges. Change passwords used on any related accounts, enable multi-factor authentication where available, and watch bank and credit statements for unexpected activity. Be sceptical of unsolicited calls or messages that cite vehicle details or recent purchases. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a check does not prove involvement in this specific incident but can indicate whether your credentials or personal information have circulated more widely. Official updates from the company or from South African regulators remain the most reliable source for confirmation of what was taken and who is affected.

AICompiled with AI assistance from public sources and published under our editorial standards.