Ransomware Gang Lockbit Reportedly Hacked in Embarrassing Leak
In an ironic twist, Lockbit — one of the world’s most notorious ransomware gangs — appears to have fallen victim to a cyberattack of its own, according to security analysts and a rogue message posted on one of the group’s darkweb sites.
On Wednesday, Lockbit’s site was replaced with a taunting message that read:
“Don’t do crime. CRIME IS BAD xoxo from Prague”
The site also included a link to what appears to be a leaked cache of internal data, potentially containing chats between Lockbit members and their victims.
While Reuters has not independently verified the data, multiple cybersecurity experts have assessed the leak and confirmed its authenticity.
“It’s legit,” said Jon DiMaggio, chief security strategist at Analyst1.
Christiaan Beek of Rapid7 noted the leak revealed Lockbit’s indiscriminate targeting — even aggressively pursuing small businesses for minor ransom payouts.
“They attack everyone,” he added.
Who hacked Lockbit remains unclear, and some of the group’s associated darkweb infrastructure is currently down, with placeholder messages stating sites will be “working soon.” However, the damage may already be done.
This is not the first time Lockbit has faced disruption. In 2023, U.K. and U.S. authorities, alongside international partners, seized parts of the gang’s infrastructure. At the time, Lockbit quickly resurfaced and defiantly declared,
“I cannot be stopped.”
But this latest incident appears more personal — and humiliating.
DiMaggio described the breach as a significant blow to the gang’s operations and credibility:
“I think it will hurt them and slow them down.”
Lockbit, once dubbed “the Walmart of ransomware” due to its prolific activity and reach, now faces a potentially destabilizing turn of events — and an unexpected reminder that even cybercriminals aren’t immune to being hacked.