grantierra.com Listed by lockbit3 Ransomware Group

On May 24, 2023, Gran Tierra Energy appeared on the LockBit 3.0 ransomware leak site with more than 150 gigabytes of internal files listed for public download. The Canadian oil and gas producer, which operates primarily in Colombia and Ecuador, is named in the listing as having suffered a ransomware attack in which attackers exfiltrated company data. The leak-site listing does not specify how many individuals are affected, but the posted material includes passports and other personal documents belonging to directors and employees.

Primary Disclosure Details

The LockBit 3.0 leak page states that Gran Tierra Energy was hit by a ransomware attack and that attackers successfully exfiltrated internal files before encryption. The disclosure indicates the stolen archive exceeds 150 GB and contains sensitive records including scanned passports of directors and staff. No exact count of exposed individuals is provided, and the notification does not detail every file type beyond the broad category of internal documents. The listing gave the company a deadline to negotiate before full publication, a standard LockBit tactic. Public reporting on the incident aligns with the leak-site claims but adds no additional victim numbers or ransom figures.

Why This Matters for You and Your Family

When an employer’s internal files containing employee passports and personal records are dumped online, the exposure reaches far beyond the workplace. If you or a family member worked at or with Gran Tierra Energy, your full name, date of birth, passport number, and possibly residential address may now sit in an easily searchable archive. That combination of identity documents allows criminals to open accounts, file fraudulent tax returns, or impersonate you with banks and government agencies. Children listed as dependents on employee records can also be pulled into the same identity web. Even if you are not an employee, contractors, business partners, or vendors whose documents were stored on the company’s systems face identical risks.

Doxxing and Identity-Chain Risks

A single leaked passport quickly links to email addresses, phone numbers, and login credentials reused across other services. Attackers chain these data points together: a corporate email from the dump is tested against gaming platforms, social media, and personal banking portals. Once one account falls, the attacker resets others using the exposed personal details. Credential leaks like this one frequently cascade into full doxxing, where home addresses, family member names, and even children’s gaming handles become public. The result is harassment, targeted phishing, or SIM-swapping attacks that can empty accounts within hours. Because the data has been freely downloadable since May 2023, the exposure window is already wide and continues to grow every day the files remain online.

LockBit 3.0 Track Record

Public reporting attributes the LockBit 3.0 variant to a ransomware operation that first appeared in early 2020 and rebranded to version 3.0 in 2022. The group has hit hospitals, manufacturers, financial firms, and energy companies worldwide. Their typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by lateral movement inside the network to locate valuable data. After exfiltration, LockBit deploys ransomware to encrypt systems and then posts samples on their leak site with a countdown clock. They often combine encryption pressure with direct extortion threats to executives whose personal documents were allegedly stolen. The Gran Tierra Energy listing follows this exact pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Rotate any password used at grantierra.com or related corporate systems anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches you or your family is caught and acted on in hours, not months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after a parent’s employer breach.
• Let remediation specialists handle takedown requests for your personal information across data-broker sites and underground forums.

The incident shows once again that corporate ransomware attacks create direct, personal exposure for ordinary employees and their families. Starting with a thorough identity review and ongoing monitoring gives you the best chance of staying ahead of attackers who already hold your data. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.