geselektrik.com.tr listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Türkiye
• Sector: Energy & Utilities
• Announcement date: December 26, 2025

The Lockbit5 ransomware group has announced that it has targeted the Turkish organization associated with the domain geselektrik.com.tr. According to a recent announcement on the group's leak site, the threat actor claims to have successfully exfiltrated data from the company, initiating a countdown process for the potential publication of the stolen information.

Details of the alleged attack

The announcement made by the Lockbit5 group specifically mentions the organization's involvement in energy infrastructure projects. The group claims to have gained unauthorized access to the organization's systems and has asserted that they have obtained data belonging to the entity. Following the initial claim, the group has started a countdown timer, a common tactic used by ransomware groups to pressure victims into meeting ransom demands before the stolen information is released publicly on their leak sites.

The nature of the specific data alleged to be leaked has not been specified in the provided records or the screenshots associated with the announcement. Consequently, the exact volume of the stolen files or the specific categories of information compromised remain unknown at this time.

Organization profile

The target of this alleged attack is GES Genel Elektrik Sistemleri Yapım ve Mühendislik A.Ş. This Turkish company specializes in providing turnkey electrical systems installation, engineering, and contracting services within the energy sector. Their operations involve complex engineering and technical services essential to energy infrastructure.

Risk assessment and implications

This alleged data breach by the Lockbit group may pose significant risks to the organization's operational continuity and commercial reputation. Depending on the specific content of the compromised data, there is a possibility that technical documents related to critical engineering projects or the personal information of employees could be exposed. Furthermore, the organization may face secondary extortion attempts through double extortion tactics, where attackers threaten to leak sensitive data if a ransom is not paid, even if the organization has backups to restore its systems.

For an organization operating in Turkey, such an incident may trigger legal obligations regarding data breach notifications under the KVKK. Additionally, leaked data can be utilized by threat actors in targeted phishing attacks against the company or its partners. The leaked information could also be used to facilitate further cyberattacks against the organization's infrastructure.

Lockbit is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported that the group has continued its operations with a new version following the disruption of their infrastructure in February 2024. Organizations in the energy and utility sector often face increased scrutiny from threat actors due to the critical nature of their infrastructure and the sensitive technical documentation they maintain.

General defensive considerations

While the specific details of this breach are still developing, organizations in critical sectors typically focus on several defensive strategies to mitigate the impact of such threats. These include maintaining robust offline backups, implementing strict access controls, and conducting regular security awareness training to prevent phishing. Monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations, such as the KVKK, are also vital components of a modern cybersecurity posture.