Skip to content

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Mandatory Privacy Policy

To the extent you are completing this form on your own behalf, and not on behalf of your agency or organization, be advised that the information on the form is being collected in accordance with the Privacy Act Statement on the IC3 homepage, Whether you are completing the form on your own behalf, or on behalf of your agency or organization, you are requested to avoid including, to the extent possible, the personally identifiable information of others. Visit IC3's Privacy Notice page for more information.

The Federal Bureau of Investigation (FBI) is investigating a ransomware campaign known as LockBit. Since January 2020, LockBit has functioned as an affiliate-based ransomware variant under the Ransomware-as-a-Service (RaaS) model. Affiliates deploy LockBit using many varying Tools, Techniques and Procedures and have attacked a wide range of businesses and critical infrastructure organizations both domestically in the United States and internationally. LockBit launched in January 2020 with a version known as LockBit 1.0, but has since released additional versions consisting of LockBit 2.0 (LockBit Red), LockBit 3.0 (LockBit Black), LockBit Linux/ESXI, LockBit Green and were developing LockBit 4.0. The FBI, in coordination with an international task force, participated in a joint disruption operation against LockBit. Below is a questionnaire for U.S. victims and non-U.S. victims who wish to participate in the U.S. LockBit prosecutions (e.g., to submit a victim-impact statement or to claim restitution), and/or are seeking additional information or help with a LockBit attack against their organization. Please complete all fields of the questionnaire to the best of your ability and the FBI will be in contact with you as soon as possible. If you have any questions, please contact

* All data provided is for investigative purposes and will not be shared publicly without the consent of the victim.

A red asterisk (*) indicates a required field.

Victim Company Information
Point of Contact
Which version(s) of LockBit was used to encrypt your system(s)?
Was there data exfiltration?
Do you need decryption assistance?
What was the financial impact to your organization?

Please specify if the ransom amounts below are in U.S. dollars (USD) or bitcoin (BTC).