unholz.ch Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The unholz.ch Listed by lockbit2 Ransomware Group (reported April 7, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The incident came to light on April 07, 2022, when unholz.ch appeared on the LockBit2 ransomware group's leak site. The group claims to have stolen internal data. No further details on the date of the intrusion, the volume of data taken, or the specific techniques used have been made public.
Who is lockbit2?
LockBit2 is the designation for a ransomware-as-a-service operation that has conducted numerous attacks since at least 2020. The group typically encrypts files on targeted systems and maintains a public leak site where it lists organizations it claims to have compromised. Listings on the site serve as a pressure tactic, with the group stating that stolen data will be released if its demands are not met. The same infrastructure has been used against entities in multiple countries and sectors.
About unholz.ch
unholz.ch is a Swiss organization operating under a .ch domain. Swiss entities in professional and commercial sectors routinely process records related to clients, contracts, employees, and internal operations. A listing involving such an organization raises questions about the handling of data that may be subject to Swiss data-protection requirements.
What was likely exposed
The only data category named in connection with the listing is internal files exfiltrated during the ransomware attack. The precise contents of those files have not been disclosed. Organizations of this type commonly maintain correspondence, financial records, personnel information, and operational documents, but it is not confirmed whether any of these categories were among the material taken.
Why it matters
Internal files can contain information that, if released, may be used for fraud, targeted scams, or competitive intelligence. For individuals whose details appear in such records, the primary risks are identity misuse and unsolicited contact. For the organization, the incident may trigger regulatory review under Swiss data-protection rules and require notification or remediation steps even when the full extent of exposure remains unclear.
If your data was in this claimed breach
Individuals concerned about possible exposure should monitor their financial and email accounts for unusual activity and consider changing passwords for any services linked to unholz.ch. Enabling multi-factor authentication on important accounts provides an additional layer of protection. Readers may also run a free exposure scan of their email address against known breach data sets to check for appearances in previously published collections.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
builditinc.com Listed by lockbit2 Ransomware Grouplundinroof.com Listed by lockbit2 Ransomware Grouprosagroup Listed by lockbit2 Ransomware Grouphilltopconstruc Listed by lockbit2 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the unholz.ch Listed by lockbit2 Ransomware Group →
Publicly posted by lockbit — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.