{ "chat_id": "Chat: *************830677", "messages": [ { "party": "Victim", "content": "[Chat started]", "timestamp": "23.09.2022 13:26:56 UTC" }, { "party": "Victim", "content": "Hello, Thank you for providing the links and ID to this chat. What proof can you give us that you have any of our data?", "timestamp": "23.09.2022 13:28:45 UTC" }, { "party": "LockBit 3.0", "content": "We have a lot of your files", "timestamp": "23.09.2022 13:41:23 UTC" }, { "party": "LockBit 3.0", "content": "Hello", "timestamp": "23.09.2022 13:41:26 UTC" }, { "party": "LockBit 3.0", "content": "What proof do you want?", "timestamp": "23.09.2022 13:41:44 UTC" }, { "party": "Victim", "content": "Please give us a full file list of data that you say you are holding, and we can chose samples of files from list for you to give us as proof.", "timestamp": "23.09.2022 14:55:24 UTC" }, { "party": "LockBit 3.0", "content": "Ok wait", "timestamp": "23.09.2022 15:43:19 UTC" }, { "party": "LockBit 3.0", "content": "Full file list size is over 8GB. we may provide you a partial listing.", "timestamp": "23.09.2022 15:44:25 UTC" }, { "party": "LockBit 3.0", "content": "Alright, finally uploading. Archiving significantly reduced the size. But I wonder how you will open it.", "timestamp": "23.09.2022 15:48:59 UTC" }, { "party": "LockBit 3.0", "content": "File list is being uploaded. It takes time. I will let you know when I'm done.", "timestamp": "23.09.2022 16:00:40 UTC" }, { "party": "LockBit 3.0", "content": "https://temp.sh/sRLaX/listfull.7z", "timestamp": "23.09.2022 21:57:38 UTC" }, { "party": "LockBit 3.0", "content": "password conti123", "timestamp": "23.09.2022 21:57:51 UTC" }, { "party": "LockBit 3.0", "content": "use https://www.emeditor.com to review list.", "timestamp": "23.09.2022 22:02:44 UTC" }, { "party": "Victim", "content": "Hello, Thank you for providing the proof of data. It will take us some time to verify the data. We will come back to you as soon as possible.", "timestamp": "23.09.2022 22:04:33 UTC" }, { "party": "LockBit 3.0", "content": "The list is very large. Hope this won't take ages to review.", "timestamp": "23.09.2022 22:07:56 UTC" }, { "party": "Victim", "content": "Sorry, it has taken us a while to be able to view and start verifying the data due to the size of the file. To prove that you hold the actual data and not just a list of files, we are currently putting together a list of samples we ask you to provide. We will send you the list asap", "timestamp": "26.09.2022 12:26:55 UTC" }, { "party": "LockBit 3.0", "content": "Hello, okay.", "timestamp": "26.09.2022 13:36:27 UTC" }, { "party": "Victim", "content": "Following up on our message from yesterday, we are still in the process of verifying information. In order to prove that you hold the actual data and not just a list of files, please can you provide the following files as proof of data held: I:\\continental2\\upload3\\did01447\\040_QAC_Cleanliness\\11_Partikelmonitoring\\02_Luftsauberkeit\\01_Monitoring\\Arbeits-Sheet-Luftsauberkeit_Auswertung Q2 2022 und Sondermessungen.xlsx, H:\\continental\\upload4_c2\\didr1618\\MMA_Fahrversuch\\06_NVH-DL_Sommer_2022\\Daten_NVH-DL_Block1\\ATF_10\\180622_004\\EKB_Data\\EEW\\180622_004_rl_nr00109_chn0007_eew.wav, H:\\continental\\upload4_c2\\didf3403\\Common\\Projects\\JR-Jeff Ross\\Instrumentation Master Database\\Archive\\Master Database Allentare Fixes March 2016.xlsx, H:\\continental\\upload4_c2\\didb3040\\MCAD\\ptc\\Help\\Creo3\\help\\creo_help_pma\\italian\\pma\\rendering\\To_Open_a_Room_File.html, I:\\continental2\\upload3\\hpfs002.tiretech.contiwan.com\\HPG-Orga\\GCF_TS\\PROJEKTE\\CT-Mexikana\\!Erweiterung 6\\CE\\Einbauerkl\u00e4rung Elektrotechnik Konwima + Kernsetzer T\u00fcrkei 2110791.pdf, E:\\continental3\\upload_c2\\did43391\\31_ProductDevelopment\\40_Software\\20_Development\\BOT\\CPC4_V4_16\\pvcs\\config\\BS_Common_src.arl, F:\\continental\\upload4\\did77091\\PROJETS\\Radio\\RD45\\07_MP\\02_MP_QualityAssurance\\210-Capabilit\u00e9_equipements\\Bizerte\\Inspection optique\\repetabilit\u00e9 vision SICKconnecteur MOST ilot 1 RD45 BCL tiroir droite.xls, E:\\continental3\\upload_c2\\did43391\\99_Workuser\\Satvanyi\\Boot_v04_16_with Source Address 0x32\\config\\BS_Appl_src.arl, F:\\continental\\upload4\\didb3019\\Konstrukce_Archiv\\P-pomocne\\P1-1103_Paletka_vytvrzen\u00ed\\Data\\(5) Pojistka_v\u00fdkres.idw, I:\\continental2\\upload3\\did35017\\Interior_Innovation_Vehicle\\03_Development\\05_Hardware\\03_Parts_Components\\14_HMI_PC\\02_OS\\Image_WINXPembed\\2_Anpassungen-Tools\\app\\DemoFPK\\DemoFPK\\msgina.dll, F:\\continental\\upload4\\didb3020\\Neplatne_NotValid\\Kvalita_Qualitaet\\Statistika\\Brandys\\KS\\Vn-Auswertung\\2002\\11_2002\\VDO\\Colorado\\VnPlov\u00e1kSest-VDO.xls, E:\\continental3\\upload_c2\\did01155\\pua\\01_Operations Controlling\\2022\\01_Actual\\01 Reporting\\00_general dashboard, E:\\continental3\\upload_c2\\did02299\\TM_community_RBG\\140415_Documentation_Test_Strategy_Safety_MY16, F:\\continental\\upload\\10Werkstoffe\\CR\\ROHSTOFF\\CC\\03\\58\\02 VULCAN 5H (Cabot, Botlek, NET)\\2 - Specification, TDS, CoA", "timestamp": "27.09.2022 17:28:58 UTC" }, { "party": "LockBit 3.0", "content": "Hello,", "timestamp": "28.09.2022 00:22:17 UTC" }, { "party": "LockBit 3.0", "content": "https://temp.sh/xJTgh/proof.7z", "timestamp": "28.09.2022 00:22:27 UTC" }, { "party": "LockBit 3.0", "content": "password conti456", "timestamp": "28.09.2022 00:22:41 UTC" }, { "party": "LockBit 3.0", "content": "Files you requested are uploaded.", "timestamp": "28.09.2022 00:23:30 UTC" }, { "party": "Victim", "content": "Thank you for providing the sample files. We will verify them and come back to you.", "timestamp": "28.09.2022 09:41:49 UTC" }, { "party": "LockBit 3.0", "content": "Hello, okay.", "timestamp": "28.09.2022 16:26:09 UTC" }, { "party": "Victim", "content": "Hello, we are still in the process of verifying information but it is taking longer than we anticipated. We hope to complete the verification work soon and appreciate your patience. Can you confirm if the list you provided covers all the data you hold?, or was it only some of it? The list did not give details of file sizes. What is the total size of all the data?", "timestamp": "03.10.2022 09:09:43 UTC" }, { "party": "LockBit 3.0", "content": "Hello. We understand. Yes, the list contains all the data we have. You have never asked for file size information. The total size exceeds 40 TB.", "timestamp": "03.10.2022 09:35:00 UTC" }, { "party": "LockBit 3.0", "content": "Hello. Your silence lasts too long. You need to pay.", "timestamp": "19.10.2022 10:16:31 UTC" }, { "party": "Victim", "content": "What guarantees do you give if a payment is made?", "timestamp": "20.10.2022 16:47:47 UTC" }, { "party": "LockBit 3.0", "content": "Hello. Your files will be deleted and nobody will know about the breach if a payment is made. Your files will appear on our leaks site if no payment is made.", "timestamp": "22.10.2022 15:00:37 UTC" }, { "party": "Victim", "content": "Hello, we have to hold a management meeting and will come back to you tomorrow end of business day.", "timestamp": "24.10.2022 13:43:32 UTC" }, { "party": "LockBit 3.0", "content": "Hello, ok.", "timestamp": "24.10.2022 15:46:09 UTC" }, { "party": "LockBit 3.0", "content": "Hello, no word from your side though it is a new business day already. You need to pay.", "timestamp": "26.10.2022 07:55:07 UTC" }, { "party": "LockBit 3.0", "content": "Hello. We've been waiting.", "timestamp": "27.10.2022 11:46:09 UTC" }, { "party": "LockBit 3.0", "content": "Should we regard your silence as a rejection of the negotiation process?", "timestamp": "28.10.2022 15:07:03 UTC" }, { "party": "LockBit 3.0", "content": "We're starting to get your data ready to be published on the blog.", "timestamp": "02.11.2022 00:53:22 UTC" }, { "party": "LockBit 3.0", "content": "Our correspondence will be attached to the post.", "timestamp": "02.11.2022 00:56:59 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion/post/ifdIXrXSkuP2S395636290a09365a", "timestamp": "03.11.2022 00:15:30 UTC" } ] }