lockbit5
First seen December 4, 2025Active361 claimed victims
The claims below are reproduced as posted by lockbit5 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| isesa.cl | February 11, 2026 | ransomware_live | — |
| renovagy.com | February 11, 2026 | ransomware_live | — |
| cmcconstruct.com | February 11, 2026 | ransomware_live | — |
| stahlwille.nl | February 6, 2026 | ransomware_live | — |
| barberopietro.it | February 4, 2026 | ransomware_live | — |
| thaihua.com | February 4, 2026 | ransomware_live | — |
| aeromedsocaustralasia.org | February 3, 2026 | ransomware_live | — |
| crystalcoastpm.com | February 3, 2026 | ransomware_live | — |
| sidercentersas.com | February 3, 2026 | ransomware_live | — |
| guarnera.com.br | January 31, 2026 | ransomware_live | — |
| kenta.com.br | January 30, 2026 | ransomware_live | — |
| gruposelpe.com.br | January 30, 2026 | ransomware_live | — |
| fastindustria.com.br | January 30, 2026 | ransomware_live | — |
| fcc-inc.com | January 29, 2026 | ransomware_live | — |
| associated.org | January 27, 2026 | ransomware_live | — |
| xpressnebs.com | January 27, 2026 | ransomware_live | — |
| lasevillanita.com | January 26, 2026 | ransomware_live | — |
| maxusacorp.com | January 26, 2026 | ransomware_live | — |
| mengseng.com | January 26, 2026 | ransomware_live | — |
| utc.com.kw | January 26, 2026 | ransomware_live | — |
| autoservizilocatelli.it | January 25, 2026 | ransomware_live | — |
| cs.at | January 25, 2026 | ransomware_live | — |
| grupoferrosider.com.br | January 23, 2026 | ransomware_live | — |
| audiconcontadores.com.br | January 22, 2026 | ransomware_live | — |
| us-duct.com | January 21, 2026 | ransomware_live | — |
| hanover-ma.gov | January 21, 2026 | ransomware_live | — |
| sevenstarsgracebay.com | January 20, 2026 | ransomware_live | — |
| moa.gov.eg | January 20, 2026 | ransomware_live | — |
| wjnklaw.com | January 18, 2026 | ransomware_live | — |
| omaxauto.com | January 18, 2026 | ransomware_live | — |
| sands.mu | January 13, 2026 | ransomware_live | — |
| limpebras.com.br | January 11, 2026 | ransomware_live | — |
| depotnapoli.com | January 6, 2026 | ransomware_live | — |
| aditusbr.com | January 2, 2026 | ransomware_live | — |
| luetz-binder.de | January 2, 2026 | ransomware_live | — |
| idefeey.yucatan.gob.mx | December 31, 2025 | ransomware_live | — |
| mtspokanepediatrics.com | December 28, 2025 | ransomware_live | — |
| urfishtrade.com | December 24, 2025 | ransomware_live | — |
| labayenylaborde.com | December 21, 2025 | ransomware_live | — |
| itgsolutions.com | December 20, 2025 | ransomware_live | — |
| davila.cl | December 17, 2025 | ransomware_live | — |
| veenkoloniaalmuseum.nl | December 16, 2025 | ransomware_live | — |
| uniplaclages.edu.br | December 15, 2025 | ransomware_live | — |
| klax.de | December 15, 2025 | ransomware_live | — |
| frandent.it | December 12, 2025 | ransomware_live | — |
| keystoliteracy.com | December 11, 2025 | ransomware_live | — |
| tuscon-physicans.com | December 7, 2025 | ransomware_live | — |
| grupoconstrutodo.com | December 7, 2025 | ransomware_live | — |
| manuaco.pt | December 7, 2025 | ransomware_live | — |
| semplastik.com.tr | December 7, 2025 | ransomware_live | — |
| shwapno.com | December 7, 2025 | ransomware_live | — |
| smed.at | December 7, 2025 | ransomware_live | — |
| q-ads.com | December 7, 2025 | ransomware_live | — |
| mc2engineers.com | December 6, 2025 | ransomware_live | — |
| prommgroup.com | December 6, 2025 | ransomware_live | — |
| milanoristorazione.it | December 5, 2025 | ransomware_live | — |
| hilden.in | December 5, 2025 | ransomware_live | — |
| axxel.biz | December 4, 2025 | ransomware_live | — |
| clipan.co.id | December 4, 2025 | ransomware_live | — |
| walters-group.co.uk | December 2, 2025 | ransomware_live | — |
| inspired.ee | December 2, 2025 | ransomware_live | — |
| formula50.it | November 28, 2025 | ransomware_live | — |
| ambisig.com | November 26, 2025 | ransomware_live | — |
| sportvision.ba | November 25, 2025 | ransomware_live | — |
| jvdbassoc.com | November 24, 2025 | ransomware_live | — |
| collinscomputing.com | November 14, 2025 | ransomware_live | — |
| drako.com.mx | November 11, 2025 | ransomware_live | — |
| kap.co.th | November 10, 2025 | ransomware_live | — |
| eroselevators.com | November 9, 2025 | ransomware_live | — |
| drogales.com.br | November 9, 2025 | ransomware_live | — |
| maasa.com.ar | November 6, 2025 | ransomware_live | — |
| cadopt.com | November 5, 2025 | ransomware_live | — |
| felixvet.com | October 30, 2025 | ransomware_live | — |
| marriott.com | October 30, 2025 | ransomware_live | — |
| iscot.it | October 27, 2025 | ransomware_live | — |
| esopdirect.com | October 25, 2025 | ransomware_live | — |
| paolidental.org | October 22, 2025 | ransomware_live | — |
| platinumpws.com | October 19, 2025 | ransomware_live | — |
| samkee.com | October 19, 2025 | ransomware_live | — |
| tracsa.com.mx | October 18, 2025 | ransomware_live | — |
| latinoseguros.com.mx | October 11, 2025 | ransomware_live | — |
| firstrateak.com | October 10, 2025 | ransomware_live | — |
| clarindahealth.com | October 8, 2025 | ransomware_live | — |
| elundini.gov.za | October 4, 2025 | ransomware_live | — |
| incolease.com | September 30, 2025 | ransomware_live | — |
| atrium.com | September 30, 2025 | ransomware_live | — |
| bardahl.com.mx | September 27, 2025 | ransomware_live | — |
| four-points.marriott.com | September 21, 2025 | ransomware_live | — |
| comune.balmuccia.vc.it | September 19, 2025 | ransomware_live | — |
| rjwalker.com | September 18, 2025 | ransomware_live | — |
| berjaya-air.com | September 17, 2025 | ransomware_live | — |
| montaury.com.br | September 12, 2025 | ransomware_live | — |
| proplastics.co.zw | September 9, 2025 | ransomware_live | — |
| npiav.com | September 3, 2025 | ransomware_live | — |
| insightchicago.com | September 2, 2025 | ransomware_live | — |
| sosltda.com | August 29, 2025 | ransomware_live | — |
| chmsbc.org.br | August 14, 2025 | ransomware_live | — |
| pilgrimpackaging.com | August 12, 2025 | ransomware_live | — |
| omf.org | May 10, 2025 | ransomware_live | — |
| technicare.com.br | May 10, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).