ibb-business-team.de Listed by lockbit3 Ransomware Group

On January 22, 2023, IBB Business Team GmbH appeared on the LockBit 3.0 ransomware leak site. The Berlin-based financing company, a wholly owned subsidiary of the IBB Group that administers public grants for start-ups, SMEs, and real estate projects on behalf of the State of Berlin, had its internal files exfiltrated during a ransomware attack. The leak-site listing does not specify the number of records affected or the exact volume of data taken.

Details from the Leak Site

The primary disclosure on the LockBit 3.0 portal states that IBB Business Team GmbH suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. No sample data was published at the time of listing, and the disclosure does not quantify affected records or name the specific systems compromised. The entry simply states that negotiations failed or were ignored and that the stolen material is now listed for public download or auction. Public reporting on LockBit 3.0 indicates the group typically sets short deadlines before full data publication, although the exact deadline for this victim was not detailed in the listing itself.

Internal files were the category of information reportedly exfiltrated. Because IBB Business Team handles grant applications, contracts, financial due-diligence documents, and correspondence with Berlin-based businesses, any exposed material could contain names, addresses, tax identifiers, banking details, and project proposals belonging to applicants and their families.

Why This Matters for You and Your Family

If you or any member of your family applied for funding through IBB Business Team programs, your personal or business information may now sit in an attacker-controlled archive. Even when exact record counts remain unknown, the exposure of internal files from a public-funding body creates concrete risk. Grant applicants often submit household addresses, telephone numbers, email accounts, and identification documents. Once such data leaves the victim’s control, it can be cross-referenced with other breaches to build detailed profiles. Families who interacted with Berlin start-up or SME support schemes between recent years should assume their details are at heightened risk of misuse for identity theft, loan fraud, or targeted phishing.

Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at one dataset. The files allegedly taken from IBB Business Team can be combined with credential leaks, data-broker records, and gaming-account compromises to create long identity chains. An email address submitted on a grant application might be the same one used for a child’s Roblox or Minecraft account; a shared phone number can link parental and dependent profiles. These linkages allow attackers to move from financial documents to live account takeovers, doxxing, and harassment. Credential leaks like this one frequently cascade into gaming platforms because families reuse passwords across work, personal, and children’s accounts. The result is a multiplying exposure that can affect every member of the household.

LockBit 3.0 Track Record

Public reporting attributes the LockBit 3.0 variant to a ransomware operation that first emerged in 2019 under the original LockBit name. The group rebranded and upgraded to LockBit 2.0 in 2021 and then to LockBit 3.0 in 2022. Notable prior victims include numerous European SMEs, healthcare providers, and local government entities. Their typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. After encryption they launch a double-extortion campaign: demanding payment to decrypt files and a second payment to prevent publication. If no ransom is received, stolen archives are posted on their leak site and sometimes offered for sale to third parties. The group is known for aggressive deadlines and for publicly naming victims who refuse to negotiate.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used on ibb-business-team.de or related IBB Group portals anywhere else it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household — DoxxScan family coverage includes dependents and children’s gaming accounts that often chain back to the same addresses or emails leaked in incidents like this.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing day-to-day accounts.

The IBB Business Team breach is a reminder that even organizations distributing public funds can become gateways to personal exposure. Taking deliberate steps now limits how far attackers can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly protects children’s gaming accounts from cascading takeovers.