mercuryit.co.nz Listed by lockbit3 Ransomware Group

On December 19, 2022, New Zealand IT services provider Mercury IT appeared on the LockBit 3.0 ransomware leak site. The listing states that the company suffered a ransomware attack in which attackers exfiltrated and encrypted more than 500 TB of customer data. The disclosure indicates that Mercury IT provides services to numerous organisations across New Zealand and Australia, meaning any individual or business whose information passed through the company may now be exposed.

Reported Details from the Listing

The LockBit 3.0 leak page explicitly claims that internal files were exfiltrated prior to encryption of the victim’s systems. The primary disclosure does not quantify the exact number of affected individuals, nor does it list specific data types such as names, addresses, financial records or health information. It simply states that more than 500 TB of customer data was taken. No ransom demand figure is published on the listing, and the exact date of initial compromise remains undisclosed by both the group and the company.

Mercury IT has not released a public breach notification detailing the incident, so the ransomware.live mirror of the LockBit 3.0 page remains the primary public record. The listing warns that data will be published if demands are not met, a standard extortion tactic used by this group.

Why This Matters for You and Your Family

When an IT services company that supports other businesses is breached, the ripple effect reaches ordinary people. Your employer, your child’s school, your doctor’s practice, or the local council may have entrusted Mercury IT with files containing your personal information. Even if you never directly engaged with Mercury IT, the data stolen could include contracts, invoices, employee records, or customer databases that list home addresses, dates of birth, phone numbers and email accounts.

Once exfiltrated data leaves the victim’s control, it can appear on dark-web markets, be traded among criminals, or be used to launch further attacks against you personally. The sheer volume—more than 500 TB—suggests that thousands of individuals across New Zealand and Australia are likely affected even though the listing does not provide a precise headcount.

The Doxxing and Identity-Chain Risk

Ransomware groups rarely stop at encryption. They exfiltrate data precisely because it can be leveraged for additional extortion or sold to other threat actors. A single leaked email or phone number from this incident can be combined with information from previous breaches to build a complete profile. Criminals then target you with phishing, SIM-swapping, or account takeover attempts that quickly escalate into full identity theft.

Credential leaks like this one cascade into gaming accounts, both yours and your children’s. A compromised work email reused for a child’s Roblox or Minecraft account can lead to doxxing that reveals your home address, especially when the same IT provider also handled family-related business records. The identity chain grows faster than most people realise.

LockBit 3.0’s Known Track Record

Public reporting attributes the LockBit ransomware operation to a Russia-based group that first emerged in 2019. It rebranded to LockBit 3.0 in early 2022 after previous versions were disrupted. The group has targeted organisations of all sizes, including hospitals, manufacturers, logistics firms and government contractors. Their typical playbook involves initial access through compromised remote desktop credentials or vulnerable web applications, followed by lateral movement inside the network, data exfiltration, and deployment of ransomware. They then pressure victims through a leak site, countdown timers, and threats to notify customers and regulators. LockBit 3.0 is known for double-extortion tactics—demanding payment both to decrypt files and to prevent publication of stolen data.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you used at Mercury IT or any related service, and secure every account with 2FA through an authenticator app rather than SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts which often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing your own digital footprint.

The Mercury IT breach is a reminder that even companies you never interact with directly can expose your family’s information. Staying ahead requires more than changing a few passwords. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists—including protection for your children’s gaming accounts that frequently become targets once credential leaks occur. Start your DoxxScan trial today and treat this incident as the prompt to lock down every link in your identity chain before the next group decides to publish.