davila.cl listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Chile
• Sector: Technology
• Announcement date: February 23, 2026

The Lockbit5 ransomware group has listed the Chilean technology organization davila.cl on its dedicated leak site. This move follows an alleged cyberattack targeting the institution, with the group claiming responsibility for the incident and threatening the potential release of the organization's data.

The alleged attack and claims by Lockbit5

The announcement regarding davila.cl was discovered on February 23, 2026. According to the claims made by the Lockbit5 group, the institution was associated with an attack that occurred on December 17, 2025. By listing the organization on their leak site, the group is signaling its intent to potentially publish the institution's data if their demands are not met.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this information publicly serves as significant leverage to pressure the victim into paying a ransom. The presence of an organization on such a site indicates that the group has moved into the stage of public pressure.

Details of the alleged data breach

At this time, there is no information provided regarding the nature of the alleged leaked data. The available evidence, such as screenshots, shows the access queue for the group's leak site rather than specific files or datasets. Consequently, the listing names no specific data types.

Risk assessment and organizational implications

This situation may indicate that the institution's network security could have been compromised. If data is indeed leaked, there may be a risk of exposure of sensitive information belonging to employees or customers. For an organization operating in the technology sector, such a breach can have wide-ranging consequences for operational integrity and trust.

Because davila.cl is based in Chile, potential data breaches may trigger obligations under local data protection regulations. Organizations must remain vigilant regarding compliance and the legal ramifications of unauthorized data exposure. Furthermore, it is possible that the leaked data could be used for identity theft or targeted phishing attacks, where attackers use stolen information to deceive individuals or gain further access to corporate networks.

Context on the threat actor

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. The group has demonstrated significant resilience in the cyber threat landscape. It is reported to have returned with a new version after its infrastructure was disrupted in February 2024.

To defend against such threats, organizations typically implement layered security strategies. This includes maintaining robust endpoint detection and response (EDR) systems, enforcing strict multi-factor authentication (MFA) across all access points, and conducting regular vulnerability assessments. Furthermore, maintaining offline, immutable backups is a critical component of a modern incident response plan to mitigate the impact of encryption-based attacks.