Ransomware victim disclosure
← All victimsLone Star Overnight (LSO)
listed as lso.com · Claimed by Embargo · listed 6 months ago
Status timeline
- Listed
Dec 6, 2025
- Data leaked
At a glance
- Group
- Embargo
- Status
- Data leaked
- Country
- LS
- Sector
- Transportation/Logistics
- Listed on leak site
- Dec 6, 2025
- Data size
- 500 GB
About the victim
AI dossier — public-source company profileLone Star Overnight (LSO), headquartered in Austin, Texas, is a leading regional parcel delivery company with over 30 years of operation. LSO offers a range of shipping services including overnight, ground, e-commerce, and Mexico delivery options, serving customers across multiple industries such as automotive, food & beverage, healthcare, and retail. The company operates a network of service centers primarily within the southern United States.
- Industry
- Regional Parcel Delivery & Shipping Logistics
- Address
- Austin, Texas, USA
Attack summary
Severity: high — The group claims both encryption of systems and exfiltration of ~500 GB of data, with data now published. As a parcel delivery company, the dataset likely contains customer PII, shipping records, and business-sensitive information at significant scale, constituting confirmed exfiltration of substantial business and potentially regulated data.The Embargo ransomware group claims to have encrypted LSO's systems and exfiltrated approximately 500 GB of data in total, publishing the data after the company allegedly failed to engage with their ransom demands.
Data the group says was taken
AI dossier — extracted from the leak post- Exfiltrated business data (~500 GB total)
- Operational/logistics records
- Potentially customer shipping data
- Potentially employee/HR data
What the group claims
Lone Star Overnight (LSO) is headquartered in Austin, Texas, and, over the last 30 years, has become a leading regional parcel delivery company. LSO has a netwo... - LSO does not understand encryption so we demonstrated for them how encryption works. We have ~500 GB data total includin...
Sources
Source
Indexed 6 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
