Incidents

LockBit

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware4,688 leak-site claims, all timeLatest observed leak-site post 2026-11-04

Malpedia ↗ETDA ↗ORKL search ↗

aka lockbit5, lockbit3

Names and spellings merged by the site editor: lockbit, lockbit3.

Names and spellings merged by the site editor: lockbit, lockbit5.

Portable threat brief

LockBit

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor: LockBit
Kind: ransomware
Aliases: lockbit5, lockbit3
Actor record created: 2021-10-08
Latest observed: 2026-11-04
Leak-site claims: 4,688
Catalogued techniques: 0

Scope

Tracked sectors: Manufacturing, Healthcare, Construction & Engineering, Education, Government
Claim records: 2021-09-09 to 2026-11-04
News stories naming this group: 2025-05-13 to 2026-11-05

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsManufacturingHealthcareConstruction & EngineeringEducationGovernment

Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2021-09-09Latest observed 2026-11-04
News stories naming this group: First observed 2025-05-13Latest observed 2026-11-05

Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

Research trail

A SecPro Super Issue: Understanding LockBitPackt2022-06-02
Lockbit 3.0: Another Upgrade to World’s Most Active RansomwareSOCRadar2022-04-06
Ransomware Spotlight: LockBitTrend Micro2022-02-08
Better Together: The Power of Managed Cybersecurity Services in the Face of Pressing Global Security ChallengesCrowdStrike2022-01-21

Bibliography via Malpedia (Fraunhofer FKIE), CC BY-NC-SA 3.0; links go to the original publisher.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand

4688 on this site

centratamagroup.comTelecommunications2026-11-04source ↗
synergy.co.idBusiness & Professional Services2026-11-01source ↗
xspringcapital.comFinancial Services2026-10-29source ↗
susannecerda.comBusiness & Professional Services2026-10-29source ↗
xspringcapital.comFinancial Services2026-10-28source ↗
susannecerda.comBusiness & Professional Services2026-10-28source ↗
zelsior.esLegal2026-10-23source ↗
dorsiacademy.itEducation2026-10-23source ↗
mlh.com.lbHealthcare2026-10-23source ↗
lidoway.comHospitality2026-10-23source ↗

View all on Breaches →

Leak-site claim activity

Claims per month, 2021-09 to 2026-11. Peak 399 in 2022-01.

2021-092026-11

Show monthly counts as a table

Month	Claims
2021-09	169
2021-10	113
2021-11	119
2021-12	68
2022-01	399
2022-02	243
2022-03	242
2022-04	245
2022-05	209
2022-06	131
2022-07	66
2022-08	127
2022-09	114
2022-10	56
2022-11	33
2022-12	55
2023-01	50
2023-02	128
2023-03	98
2023-04	114
2023-05	77
2023-06	62
2023-07	51
2023-08	125
2023-09	85
2023-10	66
2023-11	112
2023-12	86
2024-01	62
2024-02	124
2024-03	55
2024-04	27
2024-05	185
2024-06	20
2024-07	32
2024-08	38
2024-09	20
2024-10	10
2024-11	5
2024-12	6
2025-01	10
2025-02	7
2025-03	5
2025-04	14
2025-05	8
2025-06	0
2025-07	1
2025-08	1
2025-09	0
2025-10	0
2025-11	0
2025-12	111
2026-01	16
2026-02	68
2026-03	106
2026-04	74
2026-05	30
2026-06	103
2026-07	10
2026-08	37
2026-09	26
2026-10	32
2026-11	2

0 additional claims without a disclosure date

News stories naming this group

15 on this site

2026-11-05breaches incidentsOctober crypto-tracker hack: Access cracked, law enforcement tokens packed
2026-11-05ransomwareFinance and Insurance Faces a 122% Ransomware Spike. Here’s How to Defend Against It.
2026-11-03ransomwareRansomware and Cyber Extortion in Q3 2026
2026-09-18ransomwareManufacturing Accounts for 22% of all Ransomware Victims
2026-09-17ransomwareRansomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
2026-09-10ransomwareWe Handed Halcyon to an Independent Firm and Told Them to Break It
2026-08-25ransomwareMexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense
2026-07-27ransomwareFBI: Breaking Affiliate Trust Sped Along LockBit's Takedown
2026-05-27threat intelPhishing and Credential Theft Are Hitting Hospitality Harder Than Any Sector. Here’s The Remedy
2026-04-15ransomwareThe German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape
2026-03-16ransomwareRansomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
2026-02-23ransomwareApache ActiveMQ Exploit Leads to LockBit Ransomware
2026-02-13ransomwareRansomware Attacks Reach Peak Levels During December 2025 Holiday Period
2025-09-10ransomwareEmerging Threat Actor: Interlock Ransomware
2025-05-13threat intelThreat Spotlight: Capitol x Kremlin: Will US Politics Reshape Russian Cyber Threats?

Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (Terms of use: credit and link required).