rajawali.com Listed by lockbit3 Ransomware Group

On February 13, 2024, the ransomware group LockBit3 added rajawali.com to its public leak site, claiming that the Indonesia-based national investment holding company had been hit by a ransomware attack in which internal files were exfiltrated. Rajawali Group operates across plantation, mining, hotel and property holdings that include Sheraton, Luxury Collection, St Regis and Four Seasons hotels, infrastructure, and transportation businesses such as Express Taxi. The leak-site listing does not disclose the number of records affected or specify which exact files were taken.

Reported Details from the Listing

The LockBit3 leak page states that Rajawali Group suffered a ransomware intrusion and that attackers successfully exfiltrated internal files before encryption. No victim count, no sample documents, and no ransom amount appear in the posting. The disclosure indicates the data was obtained during a ransomware attack and is now hosted on the group’s onion site for anyone to view or download. Public mirrors of the listing, including ransomware.live, preserve the original February 13, 2024 timestamp and state the entry remains active.

Internal files exfiltrated is the only description provided; the listing does not detail whether employee records, customer databases, financial spreadsheets, contracts, or hotel guest information were included.

Why This Matters for You and Your Family

When a large investment holding company like Rajawali is breached, the ripple effects reach ordinary people. If you have stayed at one of their managed hotels, used Express Taxi, or done business with any of their plantation, mining, or infrastructure subsidiaries, your personal information may have been inside the stolen files. Even when exact data types remain unknown, ransomware operators routinely harvest names, addresses, phone numbers, email accounts, government identification numbers, and payment details. Once those records leave the company’s control, they can appear on multiple underground markets for years.

Your family’s exposure is not limited to one leak. A single compromised email or phone number becomes the starting point for credential-stuffing attacks against banks, government portals, and children’s school accounts. The disclosure makes clear that internal files were taken; therefore anyone whose data touched Rajawali’s systems should treat the incident as a permanent compromise of whatever information was stored there.

Doxxing and Identity-Chain Risks

Stolen internal files often contain spreadsheets that link employee or customer identities to addresses, phone numbers, dates of birth, and sometimes family-member details. Attackers and subsequent buyers can combine this data with information from other breaches to build complete identity profiles. A hotel booking record might reveal not only your name and credit-card number but also the names of traveling companions, including children. Those linkages allow doxxing campaigns that publish home addresses, family photographs, and real-time location data derived from transportation or loyalty-program records.

Gaming accounts belonging to children are especially vulnerable because the same email address or phone number used for a hotel reservation is frequently reused as a recovery contact for Roblox, Fortnite, or Steam. A single leak can therefore cascade into account takeovers that expose chat logs, friend lists, and voice recordings. The identity chain grows quickly: one exposed record today can unlock multiple services tomorrow.

LockBit3’s Publicly Known Track Record

Public reporting attributes LockBit3 as the current iteration of the LockBit ransomware operation, which first appeared in 2019 and rebranded after law-enforcement actions against earlier versions. The group has targeted hospitals, manufacturers, financial firms, and government agencies worldwide. Its typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by rapid lateral movement, data exfiltration, and then dual extortion: demanding ransom for decryption keys while threatening to publish stolen files if payment is not made. LockBit3 continues to recruit affiliates and maintains a leak site that lists victims who refuse to pay, often releasing additional data samples over time to increase pressure.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly where Rajawali-related data may surface.
• Rotate any password you used at rajawali.com or any of its hotel, taxi, or subsidiary services, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught and acted on within hours.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts which often chain back to the same addresses and recovery contacts exposed in corporate leaks.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing accounts.

The Rajawali listing is a reminder that even large, diversified holding companies can lose control of internal data with direct consequences for customers and employees. Treating this claimed breach as the start of a long-term exposure rather than a one-time event gives you the best chance to limit damage. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand and close the gaps this incident created for you and your family.