123.com Listed by lockbit3 Ransomware Group

On March 31, 2023, the ransomware group LockBit3 added 123.com to its public leak site, claiming that internal files had been exfiltrated during a ransomware attack. The listing does not disclose the number of people affected or specify which exact records were taken, leaving thousands of customers and employees uncertain about their exposure.

Reported Details from the Listing

The LockBit3 leak site entry states that internal files were exfiltrated after a ransomware deployment at 123.com. No victim count, no list of data types beyond the generic description, and no ransom deadline appear in the primary posting. The disclosure simply states that data was stolen and is now held by the operators. Public mirrors of the onion site, such as those aggregated on ransomware.live, preserve the original claim without adding unverified specifics.

Why This Matters for You and Your Family

When a company that holds your personal information suffers a ransomware breach, the stolen files often contain names, addresses, dates of birth, contact details, or account credentials. Even without an exact count, the exposure creates immediate risk for anyone who has done business with 123.com. Your family members listed on shared accounts or joint records are equally exposed. Once data leaves the company’s control, it can circulate indefinitely on criminal forums, increasing the chance of identity theft, phishing campaigns, or fraudulent loan applications in your name.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently include email addresses, usernames, or phone numbers that link your online handles to your real-world identity. Threat actors then cross-reference these details across other breaches, building a complete profile that can lead to doxxing, SIM-swapping, or targeted extortion. Credential leaks of this kind routinely cascade into gaming account takeovers, especially for children whose usernames and shared family emails appear in the same datasets. A single breach can therefore expose not just financial records but also social-media accounts, streaming profiles, and private messages that attackers use to harass or impersonate victims.

LockBit3’s Known Track Record

Public reporting attributes LockBit3 as the successor to earlier LockBit iterations that first appeared in 2019. The group has targeted organizations across healthcare, education, manufacturing, and technology sectors, routinely exfiltrating data before encrypting systems. Their standard playbook involves initial access through compromised credentials or vulnerable remote-desktop services, followed by lateral movement, data theft, and dual extortion—demanding payment both to prevent publication and to receive a decryptor. The March 2023 listing of 123.com fits this pattern, although the precise initial-access method used against this victim remains unknown.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used at 123.com wherever it has been reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or email.
• Let remediation specialists manage takedown requests for any exposed personal information appearing on data-broker or extortion sites.

The 123.com breach is a reminder that ransomware operators continue to treat stolen personal data as a marketable asset long after the initial attack. Taking deliberate steps now limits how far attackers can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts at risk from cascading credential leaks.