onyourmark.org Listed by lockbit3 Ransomware Group

On November 20, 2023, the nonprofit organization onyourmark.org appeared on the LockBit 3.0 ransomware leak site, claiming that internal files had been exfiltrated during a ransomware attack. The listing affects anyone whose personal information was stored in the organization’s systems, including individuals with intellectual and developmental disabilities, their families, staff members, and donors whose records may now sit in the hands of extortionists.

Reported Details from the Listing

The LockBit 3.0 leak page states that On Your Mark suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. The disclosure does not quantify how many records were taken, list specific data types such as names, Social Security numbers, medical details, or financial information, or provide a ransom demand. It simply marks the organization as compromised and displays a countdown timer typical of the group’s extortion playbook. The primary source remains the onion link hosted on the LockBit infrastructure, mirrored publicly through ransomware.live at http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/EypQYeiYzry7ZOvr65590eb37e836.

Why This Matters for You and Your Family

When a community nonprofit that supports people with intellectual and developmental disabilities is breached, the exposure reaches far beyond the office walls. Families who rely on these services often share sensitive details about medical histories, guardianship arrangements, government benefit identifiers, and contact information. If those records were inside the stolen files, your family’s private information is now at risk of being sold or published. Even without an exact victim count, the high-severity ransomware listing signals that operational data containing personal identifiers was taken. For ordinary families already navigating complex care systems, this adds another layer of worry about identity theft, benefit fraud, or unwanted exposure of a loved one’s disability-related records.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at encrypting files. Once data leaves the victim’s network it enters underground markets where handles, emails, phone numbers, and partial personal records are stitched together into detailed profiles. A single leaked email from an On Your Mark intake form can link to your child’s school account, your spouse’s workplace login, or family addresses used across government assistance portals. These connections create doxxing chains that allow criminals to harass, impersonate, or target families for further scams. Credential leaks of this nature frequently cascade into gaming account takeovers, especially for children who share family email addresses or passwords. The longer the data sits on a leak site, the higher the chance that opportunistic actors will exploit these links.

LockBit 3.0’s Known Track Record

Public reporting attributes LockBit’s original operations to 2019, with LockBit 3.0 emerging in 2022 as a more aggressive evolution of the earlier strains. The group has hit hospitals, schools, manufacturers, and nonprofits worldwide, typically gaining initial access through compromised remote desktop credentials, phishing, or exploited vulnerabilities in unpatched software. Once inside, they exfiltrate data before deploying ransomware, then pressure victims with dual extortion: threats to publish stolen files combined with demands for payment to prevent release. LockBit 3.0 maintains a leak site that automatically publishes samples if the victim does not pay, a tactic designed to maximize public embarrassment and pressure. While exact success rates remain opaque, the group’s persistent presence on multiple leak mirrors demonstrates it continues to extract payments or force data dumps from organizations that cannot or will not meet its deadlines.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at onyourmark.org or related community-service portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts commonly chained to the same family address or email.
• Let remediation specialists manage data-broker takedown requests and opt-out processes that would otherwise consume months of your time.

The appearance of onyourmark.org on the LockBit 3.0 leak site is a reminder that even mission-driven nonprofits can become gateways to personal exposure for the families they serve. Taking deliberate steps now limits how far attackers can travel down the identity chain created by this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.