norton.com.ar Listed by lockbit3 Ransomware Group

On April 23, 2023, the ransomware group LockBit3 added norton.com.ar to its public leak site, stating that the Argentine branch of the well-known cybersecurity company had been hit by a ransomware attack and that internal files had been exfiltrated. The listing noted that the company refused to negotiate further, with the actors writing, “If the management doesn’t care about their data, then we don’t care either.” The disclosure does not specify the number of people affected or list exact data types beyond claiming that internal files were taken.

Reported Details from the Leak Site

The primary disclosure on the LockBit3 leak site states that norton.com.ar suffered a ransomware intrusion in which attackers gained access to internal systems and exfiltrated files. No victim count is provided, and the listing does not detail the precise contents of the stolen data. The group gave the company a deadline to respond or face full publication; when negotiations broke down, the files were posted. This matches the public pattern LockBit3 has used on its onion site for dozens of prior victims.

Why This Matters for You and Your Family

Even though the victim is a regional Norton subsidiary, any breach of a cybersecurity company’s internal files can expose partner information, customer support records, employee details, or vendor contracts that indirectly affect ordinary users. If your email, phone number, or other personal information was stored in those systems, it may now be circulating among criminals. For families this means heightened risk of phishing campaigns, identity theft attempts, or follow-on attacks that start with data reportedly stolen from a company many rely on for antivirus protection.

Internal files exfiltrated in ransomware incidents frequently contain spreadsheets, databases, or configuration files that link real identities to emails, phone numbers, and addresses. Once that information leaves the company’s control, it can be sold or used to target you and your household directly.

The Doxxing and Identity-Chain Risk

Ransomware leaks like this one rarely stay isolated. Criminals routinely cross-reference stolen internal files with other breach data to build detailed identity chains. A single email or phone number found in the norton.com.ar files can be linked to your accounts on shopping sites, social media, or children’s gaming platforms. These chains allow attackers to reset passwords, impersonate you, or launch convincing spear-phishing attacks. Gaming accounts belonging to children are especially vulnerable because they often reuse credentials or recovery emails that appear in corporate leaks.

LockBit3’s Known Track Record

Public reporting attributes LockBit3 as the rebranded continuation of the original LockBit group that first appeared in 2019. The gang re-emerged as LockBit 2.0 in 2021 and then as LockBit3 in 2022 after law-enforcement pressure. Notable prior victims include large corporations, healthcare providers, and technology firms across multiple continents. Their typical playbook involves initial access through compromised remote desktop credentials or vulnerable web applications, followed by rapid lateral movement, data exfiltration, and then dual extortion—demanding payment both to decrypt systems and to prevent publication of stolen files. When victims refuse to pay, LockBit3 publishes samples and eventually the full archive on their leak site, as occurred with norton.com.ar.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used at norton.com.ar or related Norton services anywhere it has been reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and recovery emails.
• Let remediation specialists manage takedown requests for any personal information that surfaces from this or linked incidents.

The norton.com.ar listing is a reminder that even security companies can become breach victims, and the data they hold about ordinary customers can quickly fuel identity theft and account takeover attempts. Staying ahead requires more than changing a few passwords. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists—including protection for your family and children’s gaming accounts that are frequently targeted once credential leaks begin to cascade. Source: LockBit3 leak site listing (via ransomware.live).