vstar.in Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target manufacturers and mid-sized firms across Asia, posting claims of network access and data theft on public leak sites as a pressure tactic. In this environment, even listings that lack independent confirmation can signal real operational disruption and potential exposure of internal records.

On 5 April 2024, the ransomware group lockbit3 listed vstar.in, the online presence of V-Star Creations, an Indian innerwear manufacturer. The group claims it conducted a ransomware attack that included the exfiltration of internal files. The number of people affected remains unknown, and public detail on the precise scope is limited. The listing itself is a claim that has not been independently verified in the available record.

Inside the incident

According to the reported facts, lockbit3 added vstar.in to its leak site on or around 5 April 2024. The group asserts that it carried out a ransomware attack and exfiltrated internal files. No further technical details—such as the initial access vector, the duration of access, the volume of data taken, or any ransom demand—have been disclosed in the public summary. The number of individuals potentially affected is listed as unknown. Independent confirmation of the intrusion, the encryption of systems, or the actual release of data is not present in the available record; the incident is therefore known primarily through the group’s own claim of listing and exfiltration.

Who is lockbit3?

LockBit 3, also known as LockBit Black, is a well-documented ransomware-as-a-service operation that has been active for several years. The group typically recruits affiliates who gain access to corporate networks, deploy encryptors, and exfiltrate data before demanding payment. It maintains a public leak site where it posts victim names and, in some cases, sample files to increase pressure. LockBit has claimed responsibility for attacks on organisations across manufacturing, logistics, professional services and other sectors worldwide. Its operators have historically used double-extortion tactics—encrypting systems while threatening to publish stolen data. In this instance, the group claims to have listed vstar.in after an attack involving internal-file exfiltration; no additional statements specific to this victim beyond that listing appear in the facts.

About vstar.in

V-Star Creations is an Indian manufacturer of innerwear and related apparel. Founded in 1995 by Sheela Kochouseph, it operates as a subsidiary of V-Guard Industries, the company established by Kochouseph Chittilappilly. The business produces and markets clothing products, maintaining manufacturing, distribution and retail channels. Organisations of this type routinely handle employee records, supplier contracts, production data, customer order information and financial documentation. A ransomware claim against such a firm raises concern because manufacturing operations depend on continuous system availability and because any compromise of internal files can affect both workforce and commercial partners. Public detail does not establish whether production systems or customer-facing platforms were disrupted.

The information in question

The facts state that internal files were exfiltrated in the claimed ransomware attack. No more granular inventory—such as employee personal data, customer lists, financial records or intellectual property—is provided. Exact contents therefore remain unconfirmed. Companies in the apparel-manufacturing sector typically store payroll and human-resources files, supplier agreements, inventory and logistics data, and sometimes customer contact or order histories. Whether any of those categories were among the files taken cannot be verified from the available information. Readers should treat the exposure as limited to the general category of “internal files” until further official disclosure occurs.

What's at stake

For individuals whose data may have been among the internal files, the practical risks include potential misuse of personal or employment details if those records later appear in criminal markets. Employees could face phishing attempts that reference authentic workplace information; suppliers or partners might see contract or pricing data used for competitive or social-engineering purposes. For the organisation itself, the claim of ransomware and data theft can interrupt operations, require forensic investigation and remediation, and create longer-term reputational and regulatory considerations under Indian data-protection expectations. Because the number of people affected is unknown and the precise data types are not itemised, the scale of these risks cannot yet be quantified. The absence of confirmed public dumps does not eliminate the possibility that material has already circulated privately.

Were you affected?

If you are a current or former employee, supplier or customer of V-Star Creations, monitor financial and email accounts for unusual activity and treat unsolicited messages that reference the company with caution. Change passwords on any work-related or personal accounts that may have been reused, and enable multi-factor authentication where available. Organisations that believe they may have been impacted should follow their incident-response procedures and consult legal or cybersecurity counsel as appropriate. Individuals can also run a free exposure scan of their email address to check whether their information has already appeared in known breach datasets; such a check provides one additional data point but cannot confirm or rule out involvement in this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.