excon.cl Listed by lockbit3 Ransomware Group

On October 24, 2023, Chilean construction company Constructora Excon S.A. appeared on the LockBit 3.0 ransomware leak site. The listing states that internal files were exfiltrated during a ransomware attack on the firm, which specializes in large-scale earth-moving projects for mining and infrastructure. The disclosure does not specify the number of records affected or list exact data types beyond “internal files.”

Primary Disclosure Details

The LockBit 3.0 leak page, still active on the onion site as of the initial publication, claims that exfiltrated data from Constructora Excon will be published if the company does not negotiate. The entry provides no victim count, no sample documents, and no breakdown of the stolen material. Public mirrors of the leak site state the posting date as October 24, 2023, and note that the actor continues to update the page with countdown timers typical of their extortion process. The company has not yet issued a public breach notification, so the precise scope remains unknown to outsiders.

Why This Matters for You and Your Family

When a construction firm like Constructora Excon suffers a ransomware breach, the exposed internal files frequently contain employee names, national identification numbers, payroll records, tax forms, and contact details for suppliers and subcontractors. If any of these documents relate to you or a family member who has worked with the company, your personal information may now be in the hands of professional extortionists. Even a single leaked Chilean RUT (tax ID) combined with an email address can open the door to tax fraud, loan applications in your name, or targeted phishing campaigns against your household.

Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at one dataset. A leaked work email or phone number from this incident can be chained with credentials from earlier breaches to seize control of personal accounts. Credential leaks like this one often cascade into gaming-platform takeovers, especially for children whose usernames and reused passwords appear in the same household data trail. Once an attacker owns a gaming account tied to a real name and address, they can harvest further details through in-game chats or linked social profiles, accelerating full identity doxxing.

LockBit 3.0 Track Record

Public reporting attributes LockBit 3.0 as the current iteration of a ransomware operation that first appeared in 2019 under the original LockBit name. The group has repeatedly targeted construction, engineering, and mining companies because those sectors rely on large file repositories and often maintain weaker segmentation between operational networks and administrative systems. Their standard playbook involves initial access through compromised remote desktop credentials or phishing, followed by rapid exfiltration of documents before encryption. Extortion then proceeds in two stages: a demand for ransom to prevent file publication and a separate threat to sell the data to other criminals. The actors have shown willingness to follow through on leaks when victims refuse to pay, making every new listing a credible risk.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any past connection to Constructora Excon.
• Rotate any password you ever used at work or with vendors tied to the company, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential chaining from this claimed breach.
• Let remediation specialists handle data-broker takedown requests and follow-up monitoring while you focus on securing day-to-day accounts.

The incident underscores that ransomware leaks now function as long-term identity risks rather than short-lived news events. One compromised construction payroll file can feed an identity chain that surfaces years later. Start your DoxxScan trial today for continuous monitoring, AI-powered identity-chain mapping, and hands-on remediation by specialists that protects both you and your family, including gaming accounts that often become the weakest link.