lockbit5
First seen December 4, 2025Active426 claimed victims
The claims below are reproduced as posted by lockbit5 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| idefeey.yucatan.gob.mx | December 31, 2025 | ransomware_live | — |
| mtspokanepediatrics.com | December 28, 2025 | ransomware_live | — |
| urfishtrade.com | December 24, 2025 | ransomware_live | — |
| labayenylaborde.com | December 21, 2025 | ransomware_live | — |
| itgsolutions.com | December 20, 2025 | ransomware_live | — |
| davila.cl | December 17, 2025 | ransomware_live | — |
| veenkoloniaalmuseum.nl | December 16, 2025 | ransomware_live | — |
| uniplaclages.edu.br | December 15, 2025 | ransomware_live | — |
| klax.de | December 15, 2025 | ransomware_live | — |
| frandent.it | December 12, 2025 | ransomware_live | — |
| keystoliteracy.com | December 11, 2025 | ransomware_live | — |
| tuscon-physicans.com | December 7, 2025 | ransomware_live | — |
| grupoconstrutodo.com | December 7, 2025 | ransomware_live | — |
| manuaco.pt | December 7, 2025 | ransomware_live | — |
| semplastik.com.tr | December 7, 2025 | ransomware_live | — |
| shwapno.com | December 7, 2025 | ransomware_live | — |
| smed.at | December 7, 2025 | ransomware_live | — |
| q-ads.com | December 7, 2025 | ransomware_live | — |
| mc2engineers.com | December 6, 2025 | ransomware_live | — |
| prommgroup.com | December 6, 2025 | ransomware_live | — |
| milanoristorazione.it | December 5, 2025 | ransomware_live | — |
| hilden.in | December 5, 2025 | ransomware_live | — |
| axxel.biz | December 4, 2025 | ransomware_live | — |
| clipan.co.id | December 4, 2025 | ransomware_live | — |
| walters-group.co.uk | December 2, 2025 | ransomware_live | — |
| inspired.ee | December 2, 2025 | ransomware_live | — |
| formula50.it | November 28, 2025 | ransomware_live | — |
| ambisig.com | November 26, 2025 | ransomware_live | — |
| sportvision.ba | November 25, 2025 | ransomware_live | — |
| jvdbassoc.com | November 24, 2025 | ransomware_live | — |
| collinscomputing.com | November 14, 2025 | ransomware_live | — |
| drako.com.mx | November 11, 2025 | ransomware_live | — |
| kap.co.th | November 10, 2025 | ransomware_live | — |
| eroselevators.com | November 9, 2025 | ransomware_live | — |
| drogales.com.br | November 9, 2025 | ransomware_live | — |
| maasa.com.ar | November 6, 2025 | ransomware_live | — |
| cadopt.com | November 5, 2025 | ransomware_live | — |
| felixvet.com | October 30, 2025 | ransomware_live | — |
| marriott.com | October 30, 2025 | ransomware_live | — |
| iscot.it | October 27, 2025 | ransomware_live | — |
| esopdirect.com | October 25, 2025 | ransomware_live | — |
| paolidental.org | October 22, 2025 | ransomware_live | — |
| platinumpws.com | October 19, 2025 | ransomware_live | — |
| samkee.com | October 19, 2025 | ransomware_live | — |
| tracsa.com.mx | October 18, 2025 | ransomware_live | — |
| latinoseguros.com.mx | October 11, 2025 | ransomware_live | — |
| firstrateak.com | October 10, 2025 | ransomware_live | — |
| clarindahealth.com | October 8, 2025 | ransomware_live | — |
| elundini.gov.za | October 4, 2025 | ransomware_live | — |
| incolease.com | September 30, 2025 | ransomware_live | — |
| atrium.com | September 30, 2025 | ransomware_live | — |
| bardahl.com.mx | September 27, 2025 | ransomware_live | — |
| four-points.marriott.com | September 21, 2025 | ransomware_live | — |
| comune.balmuccia.vc.it | September 19, 2025 | ransomware_live | — |
| rjwalker.com | September 18, 2025 | ransomware_live | — |
| berjaya-air.com | September 17, 2025 | ransomware_live | — |
| montaury.com.br | September 12, 2025 | ransomware_live | — |
| proplastics.co.zw | September 9, 2025 | ransomware_live | — |
| npiav.com | September 3, 2025 | ransomware_live | — |
| insightchicago.com | September 2, 2025 | ransomware_live | — |
| sosltda.com | August 29, 2025 | ransomware_live | — |
| chmsbc.org.br | August 14, 2025 | ransomware_live | — |
| pilgrimpackaging.com | August 12, 2025 | ransomware_live | — |
| omf.org | May 10, 2025 | ransomware_live | — |
| technicare.com.br | May 10, 2025 | ransomware_live | — |
| laval-virtual.com | May 9, 2025 | ransomware_live | — |
| lfval.net | May 8, 2025 | ransomware_live | — |
| mostykatowice.pl | May 8, 2025 | ransomware_live | — |
| tealca.com | May 8, 2025 | ransomware_live | — |
| tecnicarobertorocca.edu.ar | May 8, 2025 | ransomware_live | — |
| towellholding.com | May 8, 2025 | ransomware_live | — |
| kraslice.cz | May 7, 2025 | ransomware_live | — |
| puzio-saunierduval.fr | May 7, 2025 | ransomware_live | — |
| soeuae.ae | May 7, 2025 | ransomware_live | — |
| jefar.be | May 6, 2025 | ransomware_live | — |
| occgrouptr.com | May 6, 2025 | ransomware_live | — |
| optral.com | May 6, 2025 | ransomware_live | — |
| savantivibranti.com | May 6, 2025 | ransomware_live | — |
| surfishtrade.com | May 5, 2025 | ransomware_live | — |
| fortrex.hu | April 29, 2025 | ransomware_live | — |
| pdcm.com | April 28, 2025 | ransomware_live | — |
| acarlar.com.tr | April 27, 2025 | ransomware_live | — |
| casabotas.es | April 27, 2025 | ransomware_live | — |
| cmc.com.br | April 26, 2025 | ransomware_live | — |
| geselektrik.com.tr | April 26, 2025 | ransomware_live | — |
| csd-drancy.com | April 25, 2025 | ransomware_live | — |
| arabfalcons.com | April 24, 2025 | ransomware_live | — |
| gccservices.eu | April 24, 2025 | ransomware_live | — |
| kll-law.com | April 22, 2025 | ransomware_live | — |
| agfri.com | April 22, 2025 | ransomware_live | — |
| bonfilet.com.tr | April 21, 2025 | ransomware_live | — |
| emresorts.com | April 21, 2025 | ransomware_live | — |
| zszeleznice.cz | April 21, 2025 | ransomware_live | — |
| yfynqygs.com | April 20, 2025 | ransomware_live | — |
| bioclimaservice.it | April 16, 2025 | ransomware_live | — |
| ehlers-inc.com | April 16, 2025 | ransomware_live | — |
| amw-treuhand.ch | April 16, 2025 | ransomware_live | — |
| d-klima.cz | April 15, 2025 | ransomware_live | — |
| fresh2you.eu | April 14, 2025 | ransomware_live | — |
| bwk-berlin.de | April 13, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).