tier1techs.screenconnect.com Listed by lockbit3 Ransomware Group

On August 16, 2022, the domain tier1techs.screenconnect.com appeared on the LockBit3 ransomware leak site, with the group claiming to have exfiltrated internal files from the managed service provider.

Details from the Leak Site

The primary disclosure on the LockBit3 leak site states that data was stolen during a ransomware attack and warns that the files will be published if the victim does not pay. The listing does not quantify how many records were taken, name specific data types beyond internal files, or provide a precise count of affected individuals. It simply states that tier1techs.screenconnect.com was compromised and that exfiltrated material is held for extortion. Public reporting on LockBit3 indicates the group typically posts a sample of stolen data and a countdown timer on its leak site when negotiations fail.

Why This Matters for You and Your Family

If you or your family members have ever received technical support from Tier 1 Techs or used their ScreenConnect remote-access service, your information may be among the stolen internal files. MSPs like this one routinely handle customer credentials, network diagrams, client contact lists, and sometimes personal details needed to provide support. When those records are taken, the exposure can reach far beyond the company itself. Anyone whose computer was remotely accessed by Tier 1 Techs could have had sensitive documents, saved passwords, or browsing history visible during those sessions. The breach therefore creates downstream risk for ordinary customers who never imagined their support tickets could end up on a ransomware leak site.

Doxxing and Identity-Chain Risks

Stolen internal MSP files often contain spreadsheets that link customer names, email addresses, phone numbers, and sometimes physical addresses. Attackers and opportunistic criminals can combine this information with data from other breaches to build complete identity profiles. A single leaked support ticket can connect your work email to your home router password or your child’s gaming username. These chains accelerate doxxing because one exposed credential frequently unlocks multiple accounts. Credential leaks of this kind have repeatedly led to takeovers of email, banking, and social-media accounts, followed by extortion demands directed at the individual rather than the original victim company.

LockBit3’s Known Track Record

Public reporting attributes the LockBit3 variant to the LockBit ransomware operation, which first appeared in 2019 and rebranded to LockBit 2.0 and later LockBit3 after law-enforcement pressure. The group has targeted hospitals, schools, local governments, and hundreds of private companies worldwide. Its typical playbook involves initial access through compromised remote-desktop services or vulnerable VPNs, followed by rapid exfiltration of documents before encryption. LockBit3 operators then demand payment in Bitcoin and threaten to release the data on their leak site or sell it to other criminals. The group is known for aggressive deadlines—often seven to ten days—and for leaking data even after partial payments in some cases.

What to do

• Rotate any password you ever used with Tier 1 Techs or on screenconnect.com and enable 2FA with an authenticator app everywhere that password was reused.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is flagged within hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often become the weak link when credential leaks cascade into takeovers and doxxing.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise consume months of your own time.

The incident underscores that even companies you hire to protect your systems can become the very source of exposure. Starting now with deliberate credential hygiene and identity-chain awareness limits how far any single breach can reach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly protects children’s gaming accounts where many doxxing chains begin.