glop.mx listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Mexico
• Sector: Professional Services
• Announcement date: March 30, 2026

Lockbit5 claims data breach at glop.mx

The Lockbit5 ransomware group has claimed responsibility for a data breach targeting glop.mx, a professional services firm based in Mexico. According to an announcement made on the group's leak site, the attackers claim to have successfully infiltrated the organization's systems and exfiltrated various types of data.

Ransomware attacks often follow a pattern of double extortion, where threat actors not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information. By threatening to release this data on a public leak site, the attackers aim to pressure the victim into paying a ransom. This method increases the pressure on the target, as the exposure of stolen data can lead to significant reputational damage, legal consequences, and operational disruptions.

Details of the alleged incident

The incident was officially announced on the Lockbit5 leak site on March 14, 2026. The group alleges that they gained unauthorized access to the systems of glop.mx and subsequently extracted data from the network. To demonstrate the validity of their claim, the group provided nine separate links that purportedly contain the stolen information.

While the group has provided these links to showcase the stolen content, the specific nature and exact contents of the leaked data have not been explicitly specified in the announcement. However, given the professional nature of the targeted organization's activities, there is a possibility that sensitive information could be involved.

About glop.mx

Glop.mx is a professional accounting firm located in Mexico. The organization specializes in the accounting and auditing sector and is noted for possessing extensive experience in these professional fields.

Risk assessment and industry implications

This breach presents several significant risks. The exposure of sensitive financial data belonging to the clients of glop.mx is a primary concern. Because the firm is based in Mexico, this incident may lead to issues regarding non-compliance with local data protection regulations. Furthermore, the leak of client information can create secondary risks, such as the potential for identity theft or the execution of targeted phishing attacks against both the firm's employees and its client base.

The Lockbit5 group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since 2019. Although the group's infrastructure faced notable disruptions in 2024, reports indicate that they have resumed operations using a new version of their software. This persistence highlights the ongoing threat posed by organized ransomware groups.

For organizations operating within the professional services sector, such as accounting and auditing firms, this incident underscores critical supply chain security risks. Because these firms handle vast amounts of third-party financial data, they often serve as high-value targets that can act as a gateway to their clients' networks. To mitigate such risks, organizations in this sector typically focus on strengthening access controls, implementing robust encryption for data at rest and in transit, and maintaining rigorous monitoring of their network environments to detect unauthorized exfiltration attempts.