lockbit5
First seen December 4, 2025Active361 claimed victims
The claims below are reproduced as posted by lockbit5 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| huisartsencentrumkleiniterson.nl | September 4, 2026 | ransomlook | — |
| kalahealth.eu | September 4, 2026 | ransomlook | — |
| pscindustries.com | September 4, 2026 | ransomlook | — |
| hoaattorneys.com | August 31, 2026 | ransomlook | — |
| svfcu.org | August 31, 2026 | ransomlook | — |
| bkc.org | August 31, 2026 | ransomlook | — |
| allsteelproducts.nl | August 31, 2026 | ransomlook | — |
| vkj.nl | August 31, 2026 | ransomlook | — |
| bartelsbv.nl | August 31, 2026 | ransomlook | — |
| apatpa.com | August 29, 2026 | ransomlook | — |
| dece.cz | August 27, 2026 | ransomlook | — |
| takt.be | August 27, 2026 | ransomlook | — |
| fpmanagement.nl | August 27, 2026 | ransomlook | — |
| tnmed.org | August 27, 2026 | ransomlook | — |
| theheartcenterofmemphis.com | August 26, 2026 | ransomlook | — |
| adt.com | August 23, 2026 | ransomware_live | — |
| icnavais.com | August 22, 2026 | ransomware_live | — |
| usbank.com | August 20, 2026 | ransomware_live | — |
| terra-petra.com | August 17, 2026 | ransomware_live | — |
| vgrn.de | August 16, 2026 | ransomware_live | — |
| tecosim.com | August 16, 2026 | ransomware_live | — |
| agricolagalbusera.it | August 16, 2026 | ransomware_live | — |
| dupouy-associes.fr | August 16, 2026 | ransomware_live | — |
| actua.fr | August 16, 2026 | ransomware_live | — |
| briggsplc.com | August 4, 2026 | ransomware_live | — |
| rai.com.br | July 29, 2026 | ransomware_live | — |
| microphase.com | July 29, 2026 | ransomware_live | — |
| setic-pourtier.com | July 27, 2026 | ransomware_live | — |
| micropack.com.ar | July 18, 2026 | ransomware_live | — |
| delkartindustries.com | July 18, 2026 | ransomware_live | — |
| pcclimitedindia.com | July 18, 2026 | ransomware_live | — |
| adventusasia.com | July 18, 2026 | ransomware_live | — |
| sms-sme.com | July 18, 2026 | ransomware_live | — |
| briggsplc.com | July 17, 2026 | ransomware_live | — |
| sirsa.it | July 13, 2026 | ransomware_live | — |
| delkartindustries.com | July 8, 2026 | ransomware_live | — |
| sirsa.it | July 5, 2026 | ransomware_live | — |
| ravagnan.com | July 3, 2026 | ransomware_live | — |
| pcclimitedindia.com | July 1, 2026 | ransomware_live | — |
| adventusasia.com | June 25, 2026 | ransomware_live | — |
| sms-sme.com | June 25, 2026 | ransomware_live | — |
| mediaservicemaastricht.nl | June 23, 2026 | ransomware_live | — |
| comtri.de | June 23, 2026 | ransomware_live | — |
| abianchini.es | June 23, 2026 | ransomware_live | — |
| giesdl.de | June 16, 2026 | ransomware_live | — |
| jshotels.com | June 15, 2026 | ransomware_live | — |
| eternal.hk | June 13, 2026 | ransomware_live | — |
| bancrofteng.com | June 13, 2026 | ransomware_live | — |
| ravagnan.com | June 11, 2026 | ransomware_live | — |
| magna.com.do | June 11, 2026 | ransomware_live | — |
| elumax.com | June 10, 2026 | ransomware_live | — |
| hotel-bourse.com | June 10, 2026 | ransomware_live | — |
| delano.k12.mn.us | June 9, 2026 | ransomware_live | — |
| probat.com | June 9, 2026 | ransomware_live | — |
| patta.com | June 8, 2026 | ransomware_live | — |
| helios.com.bo | June 3, 2026 | ransomware_live | — |
| probat.ag | June 3, 2026 | ransomware_live | — |
| grupodetoni.com.br | May 26, 2026 | ransomware_live | — |
| hgs-wt.at | May 26, 2026 | ransomware_live | — |
| venelectronics.com | May 20, 2026 | ransomware_live | — |
| hollandbulbfarms.com | May 19, 2026 | ransomware_live | — |
| dobarro.com.uy | May 18, 2026 | ransomware_live | — |
| columbiaorthogroup.com | May 17, 2026 | ransomware_live | — |
| shottermill-jun.surrey.sch.uk | May 17, 2026 | ransomware_live | — |
| majorcineplex.com | May 16, 2026 | ransomware_live | — |
| amc.co.th | May 16, 2026 | ransomware_live | — |
| vth.nl | May 15, 2026 | ransomware_live | — |
| utb.edu.vn | May 15, 2026 | ransomware_live | — |
| nundungopee.mu | May 15, 2026 | ransomware_live | — |
| weinwurm.cc | May 15, 2026 | ransomware_live | — |
| union-chemical.co.th | May 15, 2026 | ransomware_live | — |
| teleton.org.hn | May 15, 2026 | ransomware_live | — |
| sra.nl | May 15, 2026 | ransomware_live | — |
| sparkinter.com | May 15, 2026 | ransomware_live | — |
| saico.co.th | May 15, 2026 | ransomware_live | — |
| parampackaging.com | May 15, 2026 | ransomware_live | — |
| inspeqingenieria.com | May 15, 2026 | ransomware_live | — |
| greyhighschool.com | May 15, 2026 | ransomware_live | — |
| rubbercompounding.com | May 15, 2026 | ransomware_live | — |
| bvi.co.bw | May 15, 2026 | ransomware_live | — |
| ag-360.ca | May 15, 2026 | ransomware_live | — |
| uni-china.com | May 12, 2026 | ransomware_live | — |
| centralromana.com.do | May 12, 2026 | ransomware_live | — |
| rjrgleanergroup.com | May 7, 2026 | ransomware_live | — |
| wessels.group | May 7, 2026 | ransomware_live | — |
| sumerfaktoring.com | May 7, 2026 | ransomware_live | — |
| santoinacio-rio.com.br | May 1, 2026 | ransomware_live | — |
| de.yangming.com | April 30, 2026 | ransomware_live | — |
| sweetome.com | April 30, 2026 | ransomware_live | — |
| lbreng.com.br | April 30, 2026 | ransomware_live | — |
| instapack.es | April 28, 2026 | ransomware_live | — |
| groupe-mbm.com | April 27, 2026 | ransomware_live | — |
| orekait.com | April 26, 2026 | ransomware_live | — |
| sierravistahospital.com | April 26, 2026 | ransomware_live | — |
| rhactushotel.com | April 22, 2026 | ransomware_live | — |
| anser-coding.com | April 22, 2026 | ransomware_live | — |
| vp-brands.com | April 22, 2026 | ransomware_live | — |
| stllc.org | April 21, 2026 | ransomware_live | — |
| implosa.com | April 21, 2026 | ransomware_live | — |
| jec.co.id | April 19, 2026 | ransomware_live | — |
Page 1 of 4Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).