lankacom.net Listed by Darkvault Ransomware Group

On March 14, 2024, Sri Lankan telecommunications provider LankaCom appeared on the leak site operated by the DarkVault ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company, which serves as a subsidiary of Singtel and operates critical communications infrastructure in Sri Lanka. Anyone whose personal data, employee records, customer details, or business documents were stored in those systems may now face long-term exposure.

Primary Disclosure Details

The DarkVault leak site listing, first observed on March 14, 2024, states that internal files were exfiltrated following a ransomware intrusion at LankaCom. The disclosure does not quantify the number of affected records, specify the exact data types beyond “internal files,” or list sample contents. It also does not state whether customer billing records, employee payroll information, or partner contracts were included. The notification simply indicates that data was stolen and is now available on the group’s extortion platform.

Public reporting on the incident draws directly from the onion-site post hosted at the address provided by ransomware.live. No separate regulatory filing or customer notification from LankaCom has been referenced in the primary source.

Why This Matters for You and Your Family

When a telecommunications company suffers a breach, the ripple effects reach ordinary customers and employees. LankaCom has provided internet, voice, and data services across Sri Lanka since 1991. If you or any member of your household has ever used their network, submitted an ID copy for account setup, or had your contact details stored in their systems, those records may now sit in an attacker-controlled archive.

Stolen internal files often contain names, addresses, national ID numbers, phone numbers, email accounts, and payment histories. Once published, this information rarely disappears. Criminals combine it with data from earlier breaches to build complete profiles that enable identity theft, loan fraud, and targeted phishing campaigns against you and your family.

Doxxing and Identity-Chain Risks

Telecom breaches create especially dangerous identity chains. Attackers can link your phone number and home address to email accounts, social-media handles, and even children’s online gaming profiles that share the same residential internet connection. A single exposed customer record can therefore unlock multiple downstream accounts.

Public reporting on similar incidents shows that once initial data appears on a ransomware leak site, follow-on doxxing often surfaces within weeks. Criminal groups publish additional “proof” packages that tie real identities to usernames, exposing family members to harassment, SIM-swapping attacks, and physical threats. The longer the data remains unmonitored, the higher the chance that these chains will be exploited.

DarkVault’s Known Track Record

Public reporting attributes DarkVault with emerging in late 2023 as a ransomware and extortion operation. The group typically gains initial access through phishing or exploited remote desktop services, exfiltrates sensitive files before deploying encryption, and then posts samples on its leak site when victims refuse to pay. Notable prior targets have included organizations in healthcare, education, and critical infrastructure sectors. Their playbook emphasizes prolonged extortion rather than immediate mass publication, often giving victims a short deadline before releasing additional data batches.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used on lankancom.net or related LankaCom services anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts sharing the same address or internet connection.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The incident underscores that even established telecommunications providers remain vulnerable to determined ransomware operators. Acting quickly on personal exposure can limit how far attackers push the stolen data. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts often targeted in follow-on attacks. Start your DoxxScan trial today to close the gaps this claimed breach has opened.