lockbit5
First seen December 4, 2025Active426 claimed victims
The claims below are reproduced as posted by lockbit5 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| casaandina.com.co | March 19, 2026 | ransomware_live | — |
| elematic.com | March 19, 2026 | ransomware_live | — |
| abandw.com | March 19, 2026 | ransomware_live | — |
| pegasussrl.com | March 18, 2026 | ransomware_live | — |
| abuhatim.com | March 18, 2026 | ransomware_live | — |
| gas.mercedes-benz.com.eg | March 18, 2026 | ransomware_live | — |
| irestal.com | March 17, 2026 | ransomware_live | — |
| rovinj-rovigno.hr | March 16, 2026 | ransomware_live | — |
| jean.com.tw | March 15, 2026 | ransomware_live | — |
| fiepe.org.br | March 14, 2026 | ransomware_live | — |
| manchester.com.mx | March 14, 2026 | ransomware_live | — |
| roamingnetworks.rs | March 14, 2026 | ransomware_live | — |
| nandrin.be | March 12, 2026 | ransomware_live | — |
| cognitivehealthit.com | March 11, 2026 | ransomware_live | — |
| vitropor.pt | March 11, 2026 | ransomware_live | — |
| villa-romane.fr | March 11, 2026 | ransomware_live | — |
| meyzietp.com | March 11, 2026 | ransomware_live | — |
| douglasstruckbodies.com | March 11, 2026 | ransomware_live | — |
| ritta.co.th | March 11, 2026 | ransomware_live | — |
| primelinkbio.com | March 11, 2026 | ransomware_live | — |
| ssskwt.com | March 10, 2026 | ransomware_live | — |
| bassignanicave.it | March 10, 2026 | ransomware_live | — |
| milanocavi.com | March 10, 2026 | ransomware_live | — |
| scbgroup.com.sg | March 10, 2026 | ransomware_live | — |
| senai.br | March 9, 2026 | ransomware_live | — |
| sesi.org.br | March 9, 2026 | ransomware_live | — |
| alcornschools.org | March 9, 2026 | ransomware_live | — |
| commerfrutta.com | March 9, 2026 | ransomware_live | — |
| mesto-jemnice.cz | March 9, 2026 | ransomware_live | — |
| awvgrazerfeld.at | March 9, 2026 | ransomware_live | — |
| contrar.it | March 9, 2026 | ransomware_live | — |
| zsfh.cz | March 9, 2026 | ransomware_live | — |
| facsrl.net | March 8, 2026 | ransomware_live | — |
| charliebears.com.au | March 7, 2026 | ransomware_live | — |
| breastcare.com | March 6, 2026 | ransomware_live | — |
| webster-schools.org | March 5, 2026 | ransomware_live | — |
| hb-technik.at | March 5, 2026 | ransomware_live | — |
| giunti.it | March 2, 2026 | ransomware_live | — |
| gov.krd | February 28, 2026 | ransomware_live | — |
| societaitalianaalimenti.it | February 28, 2026 | ransomware_live | — |
| tanufwater.com | February 28, 2026 | ransomware_live | — |
| diesel-electric.co.za | February 26, 2026 | ransomware_live | — |
| glop.mx | February 26, 2026 | ransomware_live | — |
| elmwoodhomecare.com | February 26, 2026 | ransomware_live | — |
| emp.id | February 26, 2026 | ransomware_live | — |
| townoforangeva.gov | February 26, 2026 | ransomware_live | — |
| index-precast.com | February 25, 2026 | ransomware_live | — |
| al-alawi.com | February 25, 2026 | ransomware_live | — |
| brassuco.com.br | February 24, 2026 | ransomware_live | — |
| flamagasindia.com | February 24, 2026 | ransomware_live | — |
| toncandigital.com | February 24, 2026 | ransomware_live | — |
| ikron.org | February 24, 2026 | ransomware_live | — |
| pkmsteel.com | February 24, 2026 | ransomware_live | — |
| cti-bat.fr | February 24, 2026 | ransomware_live | — |
| ombudsman.gov.ws | February 23, 2026 | ransomware_live | — |
| yaomazi.com | February 21, 2026 | ransomware_live | — |
| frasierlaw.com | February 20, 2026 | ransomware_live | — |
| praxis-oberhof.ch | February 19, 2026 | ransomware_live | — |
| wilhelmsen.com | February 18, 2026 | ransomware_live | — |
| landsteiner.net | February 18, 2026 | ransomware_live | — |
| smilescare.com | February 17, 2026 | ransomware_live | — |
| humsnlr.com | February 15, 2026 | ransomware_live | — |
| czkingdee.com | February 15, 2026 | ransomware_live | — |
| dmxm.com | February 15, 2026 | ransomware_live | — |
| vilati.com | February 15, 2026 | ransomware_live | — |
| isesa.cl | February 11, 2026 | ransomware_live | — |
| renovagy.com | February 11, 2026 | ransomware_live | — |
| cmcconstruct.com | February 11, 2026 | ransomware_live | — |
| stahlwille.nl | February 6, 2026 | ransomware_live | — |
| barberopietro.it | February 4, 2026 | ransomware_live | — |
| thaihua.com | February 4, 2026 | ransomware_live | — |
| aeromedsocaustralasia.org | February 3, 2026 | ransomware_live | — |
| crystalcoastpm.com | February 3, 2026 | ransomware_live | — |
| sidercentersas.com | February 3, 2026 | ransomware_live | — |
| guarnera.com.br | January 31, 2026 | ransomware_live | — |
| kenta.com.br | January 30, 2026 | ransomware_live | — |
| gruposelpe.com.br | January 30, 2026 | ransomware_live | — |
| fastindustria.com.br | January 30, 2026 | ransomware_live | — |
| fcc-inc.com | January 29, 2026 | ransomware_live | — |
| associated.org | January 27, 2026 | ransomware_live | — |
| xpressnebs.com | January 27, 2026 | ransomware_live | — |
| lasevillanita.com | January 26, 2026 | ransomware_live | — |
| maxusacorp.com | January 26, 2026 | ransomware_live | — |
| mengseng.com | January 26, 2026 | ransomware_live | — |
| utc.com.kw | January 26, 2026 | ransomware_live | — |
| autoservizilocatelli.it | January 25, 2026 | ransomware_live | — |
| cs.at | January 25, 2026 | ransomware_live | — |
| grupoferrosider.com.br | January 23, 2026 | ransomware_live | — |
| audiconcontadores.com.br | January 22, 2026 | ransomware_live | — |
| us-duct.com | January 21, 2026 | ransomware_live | — |
| hanover-ma.gov | January 21, 2026 | ransomware_live | — |
| sevenstarsgracebay.com | January 20, 2026 | ransomware_live | — |
| moa.gov.eg | January 20, 2026 | ransomware_live | — |
| wjnklaw.com | January 18, 2026 | ransomware_live | — |
| omaxauto.com | January 18, 2026 | ransomware_live | — |
| sands.mu | January 13, 2026 | ransomware_live | — |
| limpebras.com.br | January 11, 2026 | ransomware_live | — |
| depotnapoli.com | January 6, 2026 | ransomware_live | — |
| aditusbr.com | January 2, 2026 | ransomware_live | — |
| luetz-binder.de | January 2, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).