aeamg.org.br listed on LockBit5 leak site following alleged data breach

• Ransomware group: Lockbit5
• Country: Brazil
• Sector: Professional Services
• Announcement date: December 7, 2025

The LockBit5 ransomware group has listed the organization aeamg.org.br on its dedicated leak site, alleging that the entity has been the victim of a data breach. This announcement, made on December 7, 2025, follows a period of alleged unauthorized access to the organization's systems.

Details of the alleged attack

According to the post published on the LockBit5 leak platform, the group claims to have compromised the organization's data. While the announcement was made in December, the group identifies the date of the attack as March 31, 2025. This significant gap between the alleged intrusion and the public listing is a common occurrence in ransomware operations.

The threat actor has established a deadline for the organization, stating that the matter must be addressed by December 21, 2025. Ransomware groups often use these public listings and deadlines as a form of pressure, a tactic frequently associated with double extortion schemes. In such scenarios, attackers not only encrypt an organization's data but also threaten to release sensitive information on public forums to coerce the victim into paying a ransom.

Information regarding compromised data

Despite the public listing, the announcement remains vague regarding the specific nature of the stolen information. The listing does not provide specific details or file samples regarding the nature of the compromised data. Furthermore, the group has not disclosed the total size of the data or the specific file count involved in the breach.

About aeamg.org.br

AEA-MG is an association representing employees and retirees of the Brazilian electric utility company CEMIG and its subsidiaries in the state of Minas Gerais. It is an organization aimed at providing social, cultural, and professional support to its members.

Analysis and potential implications

This announcement by the LockBit5 group suggests that the organization's network security may have been compromised. The potential exposure of personal information belonging to employees and members could lead to legal obligations under Brazil's LGPD regulations. If the alleged data is published, secondary risks such as identity theft and targeted phishing attacks against members may arise.

Given that LockBit is a Ransomware-as-a-Service (RaaS) group that has been active since 2019, it is assessed that such claims should be treated with caution. Organizations facing such threats often find it necessary to initiate forensic investigations to determine the actual scope of the potential data breach and to identify the entry point used by the attackers.

For organizations in the professional services sector, maintaining robust defensive postures is critical. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect anomalous behavior. When a breach is suspected, the immediate priority is often containment and the engagement of incident response professionals to mitigate further risk to the organization and its members.