inspired.ee listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Estonia
• Sector: Professional Services
• Announcement date: December 26, 2025

The Lockbit5 ransomware group has listed the Estonian media agency inspired.ee on its leak site, alleging that the organization has been the victim of a data breach. This announcement, made on December 26, 2025, follows a period of alleged unauthorized access to the company's systems.

The alleged attack and extortion attempt

According to the claims made by the Lockbit5 group, the targeted attack against inspired.ee took place on December 2, 2025. The group has posted the organization's name on their dedicated leak site, a common tactic used in modern ransomware operations. By listing the victim publicly, the threat actors appear to be exerting ransom pressure through the threat of publishing sensitive information.

Ransomware groups often utilize these leak sites to shame organizations into paying ransoms. This method, frequently referred to as double extortion, involves both encrypting an organization's data to disrupt operations and stealing sensitive information to use as leverage for blackmail. By threatening to release the data to the public or its competitors, the attackers aim to maximize the pressure on the victim to meet their financial demands.

Details regarding the leaked data

At this stage of the incident, the group has not provided any specific details regarding the content of the leaked data. No information has been released concerning the volume of files involved or the specific types of data that may have been compromised during the alleged breach.

• No data types were specified in the listing.

About inspired.ee

Inspired Universal McCann is a major player in the media landscape of Estonia and the Baltic region. As the largest media agency in these areas, the organization provides a wide range of strategic services, including media planning, media buying, and strategic communication services for its clients.

Risk assessment and organizational implications

This incident may pose significant risks to the institution's operational continuity and the confidentiality of client data. Because the organization operates within Estonia, any confirmed data breaches may lead to legal sanctions under the EU General Data Protection Regulation (GDPR). The potential exposure of sensitive information can lead to secondary risks, such as identity theft or targeted phishing attacks directed at the organization's clients and employees.

Lockbit5 is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. It is notable that the group resumed its operations with a new version following infrastructure disruptions that occurred in February 2024. This resilience highlights the ongoing threat posed by organized ransomware groups in the current cyber threat landscape.

For organizations in the professional services sector, such incidents underscore the necessity of robust cybersecurity frameworks. To mitigate the impact of such threats, organizations typically need to initiate internal audit processes to verify the validity of leak claims. Furthermore, notifying relevant data protection authorities is a critical step in complying with regulatory requirements and ensuring transparency during a security incident.

Defensive strategies for organizations often include maintaining rigorous backup protocols, implementing multi-factor authentication, and conducting regular security awareness training to prevent initial access. As the situation involving inspired.ee develops, the focus remains on determining the scope of the breach and addressing the potential legal and operational consequences.