Skip to content
Ransomware

dobarro.com.uy listed on Lockbit5 leak site

Uruguay-based retail company dobarro.com.uy has been listed on the leak site of the LockBit ransomware group.

By
Siberpol Intelligence Unit
Published
3 min read
3 min read
  • Ransomware group: Lockbit5
  • Country: Uruguay
  • Sector: Retail & E-Commerce
  • Announcement date: June 11, 2026

The LockBit5 ransomware group has published an announcement on its leak site involving the Uruguayan organization dobarro.com.uy. The group claims to have conducted cyber activities targeting the institution's systems, marking a new addition to the group's list of victims.

Details of the alleged attack

According to the announcement recorded on June 11, 2026, the LockBit5 group has officially listed dobarro.com.uy on its platform. While the listing was made public in June, the group states that the actual attack took place on May 18, 2026. This gap between the initial intrusion and the public announcement is a common occurrence in ransomware operations, where attackers may spend time exfiltrating data before moving to the extortion phase.

The group's claim of targeting the institution's systems suggests a targeted operation rather than a random scan. Ransomware leak sites are frequently used by threat actors to apply pressure on victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly to coerce the victim into paying a ransom. This method increases the pressure on the target, as the threat of a public data leak can lead to significant reputational and legal consequences.

Data and information involved

Regarding the specific content of the alleged breach, the group has not provided any details concerning the nature of the data that may have been leaked. No information has been shared regarding the volume of data or the specific number of files involved. The only visual evidence provided by the group is a screenshot that appears to belong to a general monitoring portal, rather than a direct view of the stolen files.

  • No specific data types were identified in the listing.

About dobarro.com.uy

Dobarro & Pichel is a company based in Uruguay. The organization specializes in the sale and maintenance of heating and air conditioning systems, operating within the retail and e-commerce sector.

Analysis and industry implications

The announcement by the LockBit5 group poses a potential threat to the operational continuity and data security of dobarro.com.uy. Because the organization is based in Uruguay, the alleged breach may necessitate compliance processes related to local data protection regulations. Furthermore, the potential leakage of information could create a foundation for identity theft or phishing attacks directed at the company's customers.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite its infrastructure being disrupted in February 2024, the group has reportedly returned with a new version, indicating that it retains the capacity to continue its operations. This resurgence highlights the persistent nature of sophisticated RaaS models that can adapt to law enforcement interventions.

For organizations operating in the retail and e-commerce sectors, such incidents underscore the importance of robust defensive measures. To mitigate the risks associated with ransomware and data exfiltration, companies often focus on several key areas:

  • Data protection and encryption: Implementing strong encryption for data at rest and in transit to ensure that even if data is stolen, it remains unreadable to unauthorized parties.
  • Network segmentation: Dividing networks into smaller segments to prevent attackers from moving laterally through the system after an initial breach.
  • Regular backups: Maintaining offline, immutable backups to ensure that systems can be restored without paying a ransom.
  • Employee training: Educating staff to recognize phishing attempts, which are a primary vector for initial access.

As threat actors continue to evolve, organizations must remain vigilant in monitoring their digital footprint and ensuring their security posture is aligned with current threat intelligence.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

Related stories