On May 24, 2023, Gran Tierra Energy appeared on the LockBit 3.0 ransomware leak site with more than 150 gigabytes of internal files listed for public download. The Canadian oil and gas producer, which operates primarily in Colombia and Ecuador, is named in the listing as having suffered a ransomware attack in which attackers exfiltrated company data. The leak-site listing does not specify how many individuals are affected, but the posted material includes passports and other personal documents belonging to directors and employees.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch grantierra.com
Get alerted the next time grantierra.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about grantierra.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Primary Disclosure Details
The LockBit 3.0 leak page states that Gran Tierra Energy was hit by a ransomware attack and that attackers successfully exfiltrated internal files before encryption. The disclosure indicates the stolen archive exceeds 150 GB and contains sensitive records including scanned passports of directors and staff. No exact count of exposed individuals is provided, and the notification does not detail every file type beyond the broad category of internal documents. The listing gave the company a deadline to negotiate before full publication, a standard LockBit tactic. Public reporting on the incident aligns with the leak-site claims but adds no additional victim numbers or ransom figures.
Why This Matters for You and Your Family
When an employer’s internal files containing employee passports and personal records are dumped online, the exposure reaches far beyond the workplace. If you or a family member worked at or with Gran Tierra Energy, your full name, date of birth, passport number, and possibly residential address may now sit in an easily searchable archive. That combination of identity documents allows criminals to open accounts, file fraudulent tax returns, or impersonate you with banks and government agencies. Children listed as dependents on employee records can also be pulled into the same identity web. Even if you are not an employee, contractors, business partners, or vendors whose documents were stored on the company’s systems face identical risks.
Doxxing and Identity-Chain Risks
A single leaked passport quickly links to email addresses, phone numbers, and login credentials reused across other services. Attackers chain these data points together: a corporate email from the dump is tested against gaming platforms, social media, and personal banking portals. Once one account falls, the attacker resets others using the exposed personal details. Credential leaks like this one frequently cascade into full doxxing, where home addresses, family member names, and even children’s gaming handles become public. The result is harassment, targeted phishing, or SIM-swapping attacks that can empty accounts within hours. Because the data has been freely downloadable since May 2023, the exposure window is already wide and continues to grow every day the files remain online.