LockBit 5.0 2026 activity
Ransomware group. 9 reports in 6 countries: 1 confirmed, 8 claimed or disputed. Latest 29 Oct 2026.
Thailand · 
Malaysia · 
Vietnam · 
Indonesia · 
Philippines · 
Egypt
🎯 What sources say
- Malaysia: Listed OCK Group in October 2026. ransomware.live
- Indonesia: Listed Energi Mega Persada, Murni Solusindo, JEC Eye Hospitals and Synergy in 2026. ransomware.live ransomware.live
- Thailand: Listed Major Cineplex and four other Thai firms on 20 June 2026, plus Thai Hua Rubber in March. ransomware.live Thailand
- Philippines: Claimed Pricon Microelectronics, whose parent confirmed a ransomware attack, and Feliz Hotel Boracay. Ransomware.live (Philippines) DeXpose
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedXspring Capital | Thailand | 29 Oct 2026 | Finance | Ransomware | LockBit 5.0 | Claimed. xspringcapital.com is listed on LockBit 5's leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedOCK Group | Malaysia | 17 Oct 2026 | Telecom | Ransomware | LockBit 5.0 | Claimed. LockBit 5 listed ock.com.my with an estimated attack date of 16 October. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedMajor Cineplex Group | Thailand | 20 Jun 2026 | Media | Ransomware | LockBit 5.0 | Claimed. LockBit 5.0 listed majorcineplex.com on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ Claimedutb.edu.vn | Vietnam | 20 Jun 2026 | Education | Ransomware | LockBit 5.0 | Claimed. LockBit 5 listed the higher education institution at utb.edu.vn on 20 June 2026, with an estimated attack date of 15 May 2026. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedJEC Eye Hospitals and Clinics | Indonesia | 11 Jun 2026 | Health | Ransomware | LockBit 5.0 | Claimed. LockBit 5.0 listed the eye hospital group with an estimated attack date of 19 April. | ransomware.live✓ 7 Nov |
| ✅ ConfirmedPricon Microelectronics (Yamaichi Electronics) | Philippines | 22 Apr 2026 | Manufacturing | Ransomware | LockBit 5.0 | Confirmed. Parent Yamaichi Electronics announced on 22 April that ransomware hit some servers at its Philippine subsidiary, confirmed on 17 April. Claimed. LockBit 5.0 listed pricon.com.ph on its leak site on 29 April and threatened to publish data. | ScanNetSecurity · DeXpose✓ 7 Nov |
 ⚠️ ClaimedPT Energi Mega Persada Tbk | Indonesia | 30 Mar 2026 | Energy | Ransomware | LockBit 5.0 | Claimed. LockBit 5.0 listed the upstream oil and gas company with an estimated attack date of 26 February. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedThai Hua Rubber PCL | Thailand | 30 Mar 2026 | Manufacturing | Ransomware | LockBit 5.0 | Claimed. LockBit 5.0 listed thaihua.com on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedMinistry of Agriculture and Land Reclamation | Egypt | 23 Feb 2026 | Government | Ransomware | LockBit 5.0 | Claimed. LockBit 5 listed moa.gov.eg on its leak site. The ministry has not commented. | Breach House · ransomware.live✓ 8 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology