Lomma Crane & Rigging Listed by trigona Ransomware Group

On January 25, 2024, construction services company J.F. Lomma, Inc., operating as Lomma Crane & Rigging, appeared on the leak site of the Trigona ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company has not yet published a formal breach notification, and the leak-site posting does not specify the number of records affected or the exact data types contained in the stolen files.

Reported Details from the Listing

The Trigona leak site entry, accessible via the onion address indexed by ransomware.live, claims that J.F. Lomma, Inc. suffered a ransomware intrusion and that attackers successfully removed internal files before encryption. No sample data has been publicly released in the initial posting, and the disclosure does not quantify how many employee, customer, or vendor records may be involved. The listing simply confirms exfiltration occurred and sets an implicit deadline for payment or further publication. Public reporting on Trigona indicates the group follows a double-extortion model: they threaten both data publication and, in some cases, direct contact with the victim’s clients.

Why This Matters for You and Your Family

Even when a company states that “internal files” were taken, those files frequently contain spreadsheets with employee names, Social Security numbers, dates of birth, addresses, and payment details. If you have ever worked for a construction firm, used Lomma Crane & Rigging’s services, or had your information shared with them as a vendor or customer, your personal data could be sitting in an attacker-controlled archive. Construction industry breaches often expose tax forms, insurance records, and equipment rental contracts that list home addresses and phone numbers. Once that information reaches criminal marketplaces, it can be used for identity theft, tax fraud, or targeted phishing against you and your family members.

The Doxxing and Identity-Chain Risks

Stolen internal files rarely stay isolated. A single spreadsheet linking an email address to a physical job site can be cross-referenced with other breaches to build a complete profile. Attackers chain this data with usernames from gaming platforms, social media handles, and family member records. The result is persistent doxxing that can lead to swatting, harassment, or account takeovers on services that rely on the same password or recovery phone number. Credential leaks like this one frequently cascade into gaming account compromises, especially for households where children use family email addresses for Roblox, Fortnite, or Steam. Continuous monitoring across breach repositories is one of the few ways to detect these linkages before they are exploited.

Trigona’s Known Track Record

Public reporting attributes the first significant activity by Trigona to late 2022. The group has targeted mid-sized businesses across manufacturing, logistics, and professional services. Notable prior victims include an Australian manufacturing supplier and several North American construction-related firms. Their typical playbook begins with phishing or compromised remote desktop credentials, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. After encryption, Trigona posts a sample or full dataset on their leak site and pressures the victim through both public shaming and private extortion emails. The group’s leak site remains active and regularly updated, indicating they maintain operational infrastructure despite law enforcement attention.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you ever used at J.F. Lomma, Inc. or related construction vendors, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught in hours rather than months.
• Cover the entire household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same breached email or address.
• Let remediation specialists manage takedown requests across data brokers and extortion sites on your behalf.

The incident underscores that construction and industrial service providers remain attractive targets because their internal files contain rich personal and financial data that fuels long-term identity crimes. Starting proactive defense now can limit the damage from both this claimed breach and the ones that will inevitably follow. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts vulnerable to credential-based takeovers.