Poole Group Investigates LockBit Ransomware Attack

Accountantsdaily.Au

Poole Group Investigates LockBit Ransomware Attack

First seen 18 Oct 2026, 20:07 UTC • •39.9

Article Content

1 / 3

Browse articles

ThreatCluster •October 18, 2026 at 20:39 UTC

•Poole Group is investigating a ransomware attack by LockBit.
•The attack involves potential data theft with a countdown to public disclosure.
•LockBit is known for its double-extortion ransomware tactics.

Poole Group, a Sunshine Coast-based accounting firm, is investigating a ransomware attack claimed by the LockBit group. The attack reportedly involved the theft of sensitive data, with a countdown timer set to reveal the data on October 25. The company has confirmed it is aware of the claims and is taking measures to contain the incident, including engaging external cybersecurity specialists. They have notified relevant Australian authorities and are assessing the impact on individuals. LockBit, known for its double-extortion tactics, has been less active recently compared to earlier years. The firm has not disclosed specific details about the data stolen or any ransom demands.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-15

LockBit claims attack on Poole Group

LockBit announced a ransomware attack on Poole Group, threatening to leak stolen data.

Cybersecurityconnect.Au

2026-10-18

Poole Group confirms investigation

Poole Group acknowledged the ransomware attack and is investigating the incident while implementing containment measures.

Accountantsdaily.Au

More articles in this cluster (2)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Ransomware
T1041 - Exfiltration Over C2 Channel
T1486 - Data Encrypted for Impact

Organization (1)

Poole Group

Threat Actor (1)

Lockbit

Relationships

Lockbit uses Ransomware
Lockbit uses T1041 - Exfiltration Over C2 Channel
Lockbit uses T1486 - Data Encrypted for Impact
Lockbit targets Poole Group

Following this threat?

Track Lockbit and Poole Group in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What data was stolen?

The specific data stolen has not been disclosed by Poole Group.

What is LockBit's attack method?

LockBit uses a double-extortion model, encrypting and stealing data, threatening to leak it if a ransom is not paid.

What actions is Poole Group taking?

Poole Group is investigating the incident, implementing containment measures, and working with cybersecurity specialists.

Continue Reading

PAYLOAD Ransomware Exploits Active Directory GPO for Disruption In April 2026, Kaspersky's Global Emergency Response Team (GERT) responded to a ransomware incident at a manufacturing organization in the Middle East. Attackers gained domain-admin-equivalent control via a compromised FortiGate SSL VPN account and created a malicious Group Policy Object (GPO) named PAYLOAD. This GPO…

UK Faces $3.3 Billion Annual Cost from Russian Cyberattacks A report titled 'The Putin Tax' estimates that Russian hostile activities, including cyberattacks and sabotage, cost the UK between $2.6 billion and $3.3 billion annually. Authored by Labour MP Graeme Downie and Dr. Dominic Reed, the report highlights that taxpayers, businesses, and public services bear these costs…