Forus.cl listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Chile
• Sector: Professional Services
• Announcement date: September 18, 2026

Lockbit5 claims data breach at forus.cl

The Lockbit5 ransomware group has officially listed the Chilean organization forus.cl on its dedicated leak site. According to an announcement published on September 18, 2026, the threat actor group claims to have successfully targeted the company and compromised its internal data. This development marks a new potential security incident for the Chilean entity, as the group's post suggests a successful intrusion into the organization's digital infrastructure.

Ransomware groups often utilize these leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's systems to halt operations but also threaten to release sensitive information to the public if a ransom is not met. This tactic is designed to exert maximum pressure on the victim by threatening their reputation and legal standing. While the listing has appeared on the group's platform, the claims made by the attackers remain unverified by independent third parties.

Details of the alleged attack

The announcement regarding forus.cl was created on September 18, 2026, the same day the group claims the attack occurred. In their post, the Lockbit5 group alleges that they have gained unauthorized access to the organization's data. However, at this stage of the incident, the group has not provided any specific details regarding the content of the files they claim to have stolen. There has been no disclosure of the volume of data involved or the specific file types that were allegedly exfiltrated.

The information currently available is limited to the group's claim of compromise. The listing does not include any specific evidence or documentation to substantiate the breach. The visual evidence provided in the announcement consists of a generic logo for the Ransomware.live platform, which does not offer any specific proof regarding the actual contents of the alleged leak or the extent of the intrusion into forus.cl's systems.

Data involved in the claim

The listing names no specific data types or categories of information that have been allegedly compromised.

About forus.cl

Forus is a prominent retail company based in Chile. Established in 1980, the organization has a long-standing presence in the market. The company specializes in the distribution and sale of various international brands, focusing on footwear, apparel, and accessories. As a major player in the retail and professional services sector, the company manages a wide range of operations related to the supply and sale of consumer goods.

Risk assessment and organizational implications

The Lockbit group is a known ransomware actor that has been active since 2019. It is worth noting that the group reportedly updated its infrastructure in February 2024. Such announcements by sophisticated ransomware groups can lead to significant operational disruptions for the targeted organization. Furthermore, if the claims are accurate, the exposure of sensitive information could lead to secondary risks, including identity theft or the launch of targeted phishing attacks against the organization's employees or customers.

For a Chile-based entity like forus.cl, a confirmed data breach could trigger complex legal proceedings under local data protection regulations. Organizations operating in the retail and professional services sectors often handle vast amounts of customer and employee information, making them high-value targets for cybercriminals. To mitigate these risks, organizations typically focus on strengthening their defensive posture through robust security frameworks, regular vulnerability assessments, and comprehensive employee training to recognize social engineering attempts.

Until the specific content of the alleged data is clarified by the parties involved, the full extent of the impact remains uncertain. The situation highlights the ongoing threat posed by ransomware groups that utilize public leak sites to increase the pressure on their victims through the threat of data exposure.