Ransomware gangs love a leak site. It is their shop window: a dark-web page listing victims, a countdown clock, and a threat to publish stolen data unless the ransom is paid.

In February 2024, visitors to LockBit's leak site found something new on the page. The logos of the UK's National Crime Agency , the FBI and a long list of international police forces. The site had been seized. And the police were just getting started.

Who LockBit was

LockBit appeared around 2019 and grew into the most prolific ransomware operation in the world. The US Justice Department later said it had attacked more than 2,000 victims and received more than $120 million in ransom payments.

It worked like a franchise, a model called ransomware-as-a-service :

The core team built and maintained the ransomware, the negotiation panel and the leak site.

Affiliates , independent criminals, broke into companies and deployed it.

Ransoms were split, with the affiliate taking the larger share.

It was a business with support staff,…