{
	"id": "ff8aca6f-5112-4fa5-8bad-cef0adde3492",
	"created_at": "2026-04-06T00:22:24.148397Z",
	"updated_at": "2026-04-10T03:20:56.081931Z",
	"deleted_at": null,
	"sha1_hash": "07d0201e9644e2f6139b0cd840cca607fb46b18d",
	"title": "Egyptian E-Payment Vendor Recovering From LockBit Ransomware Attack",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1897868,
	"plain_text": "Egyptian E-Payment Vendor Recovering From LockBit\r\nRansomware Attack\r\nBy Georgia Lewis\r\nPublished: 2023-11-28 · Archived: 2026-04-05 13:25:42 UTC\r\nSource: 3D generator via Alamy Stock Photo\r\nThe LockBit 3.0 ransomware group successfully encrypted files and also allegedly exfiltrated data from Egyptian\r\ne-payment provider Fawry.\r\nWord of the breach went public when LockBit published on its dedicated leak site on Nov. 8 a sample of data that\r\nwas allegedly stolen during the breach of Fawry’s infrastructure. The following day, cybersecurity monitoring\r\nplatform Hackmanac claimed that the LockBit 3.0 ransomware attack had extracted the personal details of Fawry\r\ncustomers, leading to multiple banks advising customers to remove their account information from Fawry's\r\nplatform. \r\nHit Files and Data\r\nIn a statement this week about the attack, Fawry said: \"Fawry remains confident that this data will not impact\r\nfinancial transactions on its platform, but the company believes it may have included the personal details of some\r\nhttps://www.darkreading.com/cyberattacks-data-breaches/fawry-recovering-from-lockbit-ransomware-attack-Page 1 of 3\n\ncustomers whose information had been on the testing platform as part of a system migration project.\" It also\r\nconfirmed that some of the leaked details include addresses, phone numbers, and dates of birth.\r\nGroup-IB was called in to investigate the incident on Nov. 9, and over three days, it deployed \"proprietary\r\nadvanced cybersecurity solutions across 100% of Fawry’s server infrastructure,\" declaring the production and\r\ntesting environments to be \"clean as of Nov. 23 of LockBit presence.\"\r\nAnurag Gurtu, CPO and co-founder of StrikeReady, says the Fawry cyberattack is notable for several reasons,\r\nincluding that the breach occurred in an isolated part of Fawry's network.\r\nHe describes Fawry’s response to the breach as \"proactive\" given that it employed a cybersecurity firm to\r\ninvestigate the attack. Gurtu recommends that other financial services entities consider the impact of this incident,\r\nand for them to take \"precautionary measures to protect against potential data misuse.\"\r\nHowever, Sumatra Sarkar, associate professor at the School of Management at Binghamton State University of\r\nNew York, criticized Group-IB and Fawry for the \"limited information\" released, making it \"challenging to assess\r\nthe adequacy of the response to the incident.\"\r\nAbout the Author\r\nhttps://www.darkreading.com/cyberattacks-data-breaches/fawry-recovering-from-lockbit-ransomware-attack-Page 2 of 3\n\nContributing Writer, Freelance writer\r\nGeorgia has worked in Australia, the Middle East and the UK, writing about a wide range of industry sectors,\r\nincluding technology, energy and automotive. She is now a freelance tech journalist based in London.\r\nSource: https://www.darkreading.com/cyberattacks-data-breaches/fawry-recovering-from-lockbit-ransomware-attack-https://www.darkreading.com/cyberattacks-data-breaches/fawry-recovering-from-lockbit-ransomware-attack-Page 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.darkreading.com/cyberattacks-data-breaches/fawry-recovering-from-lockbit-ransomware-attack-"
	],
	"report_names": [
		"fawry-recovering-from-lockbit-ransomware-attack-"
	],
	"threat_actors": [],
	"ts_created_at": 1775434944,
	"ts_updated_at": 1775791256,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/07d0201e9644e2f6139b0cd840cca607fb46b18d.pdf",
		"text": "https://archive.orkl.eu/07d0201e9644e2f6139b0cd840cca607fb46b18d.txt",
		"img": "https://archive.orkl.eu/07d0201e9644e2f6139b0cd840cca607fb46b18d.jpg"
	}
}