{"id":3549,"date":"2025-05-15T04:29:07","date_gmt":"2025-05-15T04:29:07","guid":{"rendered":"https:\/\/certera.com\/blog\/?p=3549"},"modified":"2025-05-15T04:29:08","modified_gmt":"2025-05-15T04:29:08","slug":"lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/","title":{"rendered":"LockBit Ransomware Gang Breached \u2014 Secrets Spilled in Major Takedown"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-an-incidence\">An Incidence<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The hunter becomes the hunted. LockBit, once the most dominant ransomware-as-a-service (RaaS) syndicate on the dark web, has been shattered from within. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a dramatic twist, the criminal enterprise infamous for extorting hundreds of millions from global victims has now suffered a severe breach of its infrastructure, exposing internal secrets, negotiation logs, affiliates, and cryptocurrency wallets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/certera.com\/blog\/ransomware-key-insights-2024-and-essential-defense-strategies-for-2025\/\">Ransomware Unveiled: Key Insights 2024 and Essential Defense Strategies for 2025<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The guy who did this left a message behind: <strong>\u201cDon&#8217;t do crime. CRIME IS BAD. xoxo from Prague.\u201d<\/strong><\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\"><strong>On May 8, 2025, <\/strong>cybersecurity communities were stunned to discover that LockBit\u2019s dark web affiliate panels were defaced, all of them replaced with the same taunting message and a link to a .zip file named paneldb_dump.zip. This 7.5 MB archive contained an SQL dump of LockBit\u2019s affiliate panel database, revealing a treasure trove of secrets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MySQL dump includes LockBit operations from December 2024 to April 29, 2025, namely:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>59,975 Bitcoin<\/strong> addresses related to payment for ransom, some of which still have <strong>over $100,000<\/strong>.<\/li>\n\n\n\n<li>Custom ransomware builds are customised to specific victim companies.<\/li>\n\n\n\n<li>Victim profiles, domain names, and revenue estimation.<\/li>\n\n\n\n<li>Negotiation <strong>transcripts 4,442 messages<\/strong> with the brutal tactics taken by LockBit to force victims to pay ransoms from thousands to <strong>over $100,000<\/strong>.<\/li>\n\n\n\n<li><strong>75 affiliate\/admin accounts<\/strong>, most of them with plaintext passwords.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The identity of the hacker himself\/herself is still unknown, though the clues indicate one actor (or a group of actors) behind the nickname <strong>\u201cxoxo from Prague\u201d.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It was the repeated use of the <strong>same defacement message<\/strong> that was utilised recently in breach of <strong>Everest ransomware\u2019s<\/strong> infrastructure. As speculations are rife, various researchers hold that the attacker might have leveraged <strong>a PHP zero-day or one-day vulnerability<\/strong> on LockBit\u2019s web backend to gain access. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>According to blockchain security company SlowMist<\/em>, this PHP vulnerability was more than likely the attack vector.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-why-this-matters\">Why This Matters?<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Affiliate Trust Is Crumbling:<\/strong> Ransomware gangs are based on trust between partners. This breach kills the credibility of LockBit, revealing private messages, negotiation behaviour, and user names.<\/li>\n\n\n\n<li><strong>Law Enforcement Jackpot:<\/strong> Wallet addresses, chat logs, and Tox IDs are an intelligence gold mine. Such details can be used to track payments, map affiliations as well as even unmask operators.<\/li>\n\n\n\n<li><strong>Reputation Beyond Repair?: <\/strong>LockBit\u2019s efforts to turn the breach into a plus, identifying that it was <strong>\u201cjust the light panel\u201d, <\/strong>and to provide bounties for spending this attacker\u2019s identity, only expose how unstable they are.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>This leak comes after Operation Cronos in 2024<\/strong>, which, partaken by the FBI, the NCA, and Europol, resulted in the temporary takedown of LockBit\u2019s activities and revealed its head, Dmitry Yuryevich Khoroshev, a Russian national by the name of \u201c<strong>LockBitSupp<\/strong>\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">LockBit had fought its way back online after Cronos, but this latest infiltration could just end doing in the group once and for all. \u201cOnly the light panel with auto registration was hacked,\u201d LockBitSupp said in a Tox chat with researcher Rey in an attempt to minimize the damage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/certera.com\/blog\/what-is-ransomware-everything-to-know-about-ransomware-attacks\/\">What is Ransomware? Everything to Know About Ransomware Attacks<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, no amount of PR can wipe off the fact that the law enforcers now have an itinerary of LockBit\u2019s activities, and affiliates have reasons to panic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Be prepared for arrests and disruptions as the leaked Bitcoin addresses and Tox handles get traced by the investigators. More leaks or retaliatory cyber attacks, particularly, with LockBit\u2019s failure being subject to study of other RaaS groups. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The underground market is slated to split into smaller pieces, as RaaS operations suffer from damage to their reputation and an increase in OPSEC costs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If even the biggest fish in the ransomware ocean, LockBit, can be hacked and embarrassed, then nobody\u2019s safe. This breach is not just a prize for cybersecurity. It is a shot across the bow for every cybercriminal on the planet.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An Incidence The hunter becomes the hunted. LockBit, once the most dominant ransomware-as-a-service (RaaS) syndicate on the dark web, has been shattered from within. In a dramatic twist, the criminal enterprise infamous for extorting hundreds of millions from global victims has now suffered a severe breach of its infrastructure, exposing internal secrets, negotiation logs, affiliates,<span class=\"morelink d-block mt-3\"><a href=\"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/\">Read More<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":3550,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[684],"class_list":["post-3549","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-breach","tag-lockbit-ransomware-data-breach","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LockBit Ransomware Gang Hacked: Critical Internal Data Exposed<\/title>\n<meta name=\"description\" content=\"The LockBit ransomware gang has suffered a data breach exposed 62K+ Bitcoin wallets, affiliate data, and ransomware-as-a-service (RaaS) ops.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LockBit Ransomware Gang Hacked: Critical Internal Data Exposed\" \/>\n<meta property=\"og:description\" content=\"The LockBit ransomware gang has suffered a data breach exposed 62K+ Bitcoin wallets, affiliate data, and ransomware-as-a-service (RaaS) ops.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/\" \/>\n<meta property=\"og:site_name\" content=\"EncryptedFence by Certera - Web &amp; Cyber Security Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/certeraLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-15T04:29:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-15T04:29:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/05\/lockbit-ransomware-hacked.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Janki Mehta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:site\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Janki Mehta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/\"},\"author\":{\"name\":\"Janki Mehta\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\"},\"headline\":\"LockBit Ransomware Gang Breached \u2014 Secrets Spilled in Major Takedown\",\"datePublished\":\"2025-05-15T04:29:07+00:00\",\"dateModified\":\"2025-05-15T04:29:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/\"},\"wordCount\":643,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/lockbit-ransomware-hacked.webp\",\"keywords\":[\"Lockbit Ransomware Data Breach\"],\"articleSection\":[\"Data Breach\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/\",\"name\":\"LockBit Ransomware Gang Hacked: Critical Internal Data Exposed\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/lockbit-ransomware-hacked.webp\",\"datePublished\":\"2025-05-15T04:29:07+00:00\",\"dateModified\":\"2025-05-15T04:29:08+00:00\",\"description\":\"The LockBit ransomware gang has suffered a data breach exposed 62K+ Bitcoin wallets, affiliate data, and ransomware-as-a-service (RaaS) ops.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#primaryimage\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/lockbit-ransomware-hacked.webp\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/lockbit-ransomware-hacked.webp\",\"width\":960,\"height\":620,\"caption\":\"LockBit Ransomware Gang Hacked\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/certera.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LockBit Ransomware Gang Breached \u2014 Secrets Spilled in Major Takedown\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"name\":\"EncryptedFence by Certera - Web & Cyber Security Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"alternateName\":\"Certera's EncryptedFence Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/certera.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\",\"name\":\"Certera\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"caption\":\"Certera\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/certeraLLC\\\/\",\"https:\\\/\\\/x.com\\\/certera_llc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/certera-llc\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\",\"name\":\"Janki Mehta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"caption\":\"Janki Mehta\"},\"description\":\"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\\\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.\",\"sameAs\":[\"https:\\\/\\\/certerassl.com\\\/\"],\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/author\\\/certerabguser\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LockBit Ransomware Gang Hacked: Critical Internal Data Exposed","description":"The LockBit ransomware gang has suffered a data breach exposed 62K+ Bitcoin wallets, affiliate data, and ransomware-as-a-service (RaaS) ops.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/","og_locale":"en_US","og_type":"article","og_title":"LockBit Ransomware Gang Hacked: Critical Internal Data Exposed","og_description":"The LockBit ransomware gang has suffered a data breach exposed 62K+ Bitcoin wallets, affiliate data, and ransomware-as-a-service (RaaS) ops.","og_url":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/","og_site_name":"EncryptedFence by Certera - Web &amp; Cyber Security Blog","article_publisher":"https:\/\/www.facebook.com\/certeraLLC\/","article_published_time":"2025-05-15T04:29:07+00:00","article_modified_time":"2025-05-15T04:29:08+00:00","og_image":[{"width":960,"height":620,"url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/05\/lockbit-ransomware-hacked.webp","type":"image\/jpeg"}],"author":"Janki Mehta","twitter_card":"summary_large_image","twitter_creator":"@certera_llc","twitter_site":"@certera_llc","twitter_misc":{"Written by":"Janki Mehta","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#article","isPartOf":{"@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/"},"author":{"name":"Janki Mehta","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7"},"headline":"LockBit Ransomware Gang Breached \u2014 Secrets Spilled in Major Takedown","datePublished":"2025-05-15T04:29:07+00:00","dateModified":"2025-05-15T04:29:08+00:00","mainEntityOfPage":{"@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/"},"wordCount":643,"commentCount":0,"publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"image":{"@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/05\/lockbit-ransomware-hacked.webp","keywords":["Lockbit Ransomware Data Breach"],"articleSection":["Data Breach"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/certera.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/","url":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/","name":"LockBit Ransomware Gang Hacked: Critical Internal Data Exposed","isPartOf":{"@id":"https:\/\/certera.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#primaryimage"},"image":{"@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/05\/lockbit-ransomware-hacked.webp","datePublished":"2025-05-15T04:29:07+00:00","dateModified":"2025-05-15T04:29:08+00:00","description":"The LockBit ransomware gang has suffered a data breach exposed 62K+ Bitcoin wallets, affiliate data, and ransomware-as-a-service (RaaS) ops.","breadcrumb":{"@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#primaryimage","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/05\/lockbit-ransomware-hacked.webp","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/05\/lockbit-ransomware-hacked.webp","width":960,"height":620,"caption":"LockBit Ransomware Gang Hacked"},{"@type":"BreadcrumbList","@id":"https:\/\/certera.com\/blog\/lockbit-ransomware-gang-breached-secrets-spilled-in-major-takedown\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/certera.com\/blog\/"},{"@type":"ListItem","position":2,"name":"LockBit Ransomware Gang Breached \u2014 Secrets Spilled in Major Takedown"}]},{"@type":"WebSite","@id":"https:\/\/certera.com\/blog\/#website","url":"https:\/\/certera.com\/blog\/","name":"EncryptedFence by Certera - Web & Cyber Security Blog","description":"","publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"alternateName":"Certera's EncryptedFence Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/certera.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/certera.com\/blog\/#organization","name":"Certera","url":"https:\/\/certera.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","caption":"Certera"},"image":{"@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/certeraLLC\/","https:\/\/x.com\/certera_llc","https:\/\/www.linkedin.com\/company\/certera-llc\/"]},{"@type":"Person","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7","name":"Janki Mehta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","caption":"Janki Mehta"},"description":"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.","sameAs":["https:\/\/certerassl.com\/"],"url":"https:\/\/certera.com\/blog\/author\/certerabguser\/"}]}},"_links":{"self":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/3549","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/comments?post=3549"}],"version-history":[{"count":2,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/3549\/revisions"}],"predecessor-version":[{"id":3554,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/3549\/revisions\/3554"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media\/3550"}],"wp:attachment":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media?parent=3549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/categories?post=3549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/tags?post=3549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}