Facsrl.net listed on LockBit5 ransomware leak site

• Ransomware group: LockBit5
• Country: Italy
• Sector: Manufacturing
• Announcement date: March 30, 2026

The Italian manufacturing company facsrl.net has been listed on the leak site of the LockBit5 ransomware group. The group has published a leak announcement claiming to have compromised data belonging to the organization, marking a potential significant security incident for the firm.

The details of the claim

The LockBit5 group has released a leak announcement asserting that they have successfully compromised data belonging to facsrl.net. According to the listing, the attack is claimed to have taken place on March 8, 2026, with the public announcement appearing on the group's leak site on March 30, 2026. The listing provides general information regarding the company's operations but does not provide specific technical details about the method of entry.

The LockBit5 group is a known threat actor that has been active since 2019. The group has reportedly updated its infrastructure as recently as February 2024. In this recent instance, the group's post includes ten separate links intended for accessing the allegedly stolen data, as shown in accompanying screenshots.

Data and content involved

Regarding the specific content of the leaked data, no specific details have been provided by the threat actors. The listing does not specify the volume of data stolen or the exact number of files involved. While the announcement includes ten download links, the exact nature of the information contained within those links remains unconfirmed. The listing names no specific data types.

About facsrl.net

FAC S.R.L. is an Italian company that was established in 1999. The organization specializes in the manufacturing sector, specifically focusing on crane rental and lifting services.

Impact assessment and industry implications

The claim made by the LockBit5 group may create negative impacts on the company's operational continuity and commercial reputation. Because the company is based in Italy, any potential data breaches may be evaluated under the General Data Protection Regulation (GDPR), which could lead to legal sanctions. Depending on the content of the leaked data, there is a risk that identity theft and targeted phishing attacks may occur if employee or customer information is exposed.

Given the past activities of the LockBit5 group, it is assessed that the group may have adopted a double-extortion method. In a double-extortion scenario, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. They threaten to publish this data on public leak sites to pressure the victim into paying a ransom.

For organizations operating in the manufacturing and heavy equipment sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive strategies typically involve maintaining offline backups, implementing strict access controls, and conducting regular security audits. Maintaining a comprehensive incident response plan is also a critical component for mitigating the operational and reputational damage caused by such threats.