Aditusbr.com listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Brazil
• Sector: Professional Services
• Announcement date: January 21, 2026

The Lockbit5 ransomware group has listed the Brazilian consulting firm aditusbr.com on its leak site. This announcement, made by the threat actor group, claims that the organization's data has been compromised in a recent cyberattack.

Details of the alleged attack

According to the post published on the group's leak site on January 21, 2026, the threat actors claim to have successfully targeted the systems of aditusbr.com. While the announcement was made in late January, the group alleges that the actual intrusion and attack on the organization's internal systems took place on January 2, 2026.

In their public communication, the group makes specific references to the firm's business operations, particularly noting its involvement and activities related to the Brazilian capital markets. This connection highlights the potential sensitivity of the target's operational environment.

Information regarding compromised data

The announcement provided by the ransomware group is notably vague regarding the specifics of the breach. The listing names no specific data types or the scope of the information that has been allegedly exfiltrated from the organization.

There is no information provided in the announcement regarding the specific type of data, the total volume of files, or the overall size of the data set claimed to be stolen. Furthermore, the group has not specified a ransom demand in relation to this particular listing.

About aditusbr.com

ADITUS is a firm based in Brazil that has been providing independent consulting services to investors since 2011. The company specializes in the fields of investment management and strategic consulting, serving a client base that requires professional guidance in complex financial environments.

Risk assessment and industry implications

Given the firm's professional activities involving consulting for investors, this claim carries the potential risk of exposing sensitive financial data or confidential client information. Such a breach could lead to significant legal and administrative sanctions for the organization under Brazil's LGPD regulations. Furthermore, the potential release of such data may create secondary risks for the firm's clients, including the possibility of identity theft or the execution of targeted phishing attacks.

Lockbit is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Following infrastructure disruptions in February 2024, the group reportedly resumed its operations using a new version of its malware. This evolution in their tactics is a common trend among sophisticated ransomware groups that adapt to defensive measures.

In such scenarios, it is often advisable for organizations to initiate a thorough forensic investigation of their internal networks to verify the validity of breach claims made by threat actors. Standard defensive measures for organizations in the professional services sector typically involve monitoring for unauthorized access, implementing strict data encryption, and maintaining robust incident response plans to mitigate the impact of potential leaks.