Iscot.it listed on LockBit5 leak site

• Ransomware group: Lockbit5
• Country: Italy
• Sector: Technology
• Announcement date: December 7, 2025

LockBit5 claims data breach at iscot.it

The LockBit5 ransomware group has listed the Italian technology company iscot.it on its dedicated leak site. The threat actor group has issued an announcement alleging that they have successfully conducted a data breach against the organization. This development follows a period of activity from the group, which has claimed the attack occurred on October 27, 2025, with the public announcement appearing on the leak site on December 7, 2025.

In typical ransomware operations, threat actors use leak sites to pressure victims into paying ransoms. This method often involves a double extortion tactic, where the attackers not only encrypt a victim's systems but also threaten to release sensitive information to the public if their demands are not met. By listing an organization on a public platform, the group aims to maximize visibility and reputational damage to compel compliance.

Details of the alleged incident

According to the announcement made by LockBit5, the group has targeted iscot.it and has set a deadline for the organization. The group has indicated that they may proceed to publish the company's data if their requirements are not satisfied by December 21, 2025. The claim suggests a high level of intent to release information to cause maximum disruption to the victim's operations and reputation.

Regarding the specific details of the breach, the current information remains limited. The listing names no specific data types that have been allegedly exfiltrated.

Information regarding the leaked data

At this stage, there is no information regarding the nature or content of the allegedly leaked data in the provided record or screenshot. No details have been provided concerning the volume of data or the specific files involved in the incident.

About iscot.it

Iscot is an Italy-based company that provides technical services, facility management, and industrial cleaning solutions for businesses. The company offers various technical support services to ensure the operational continuity of facilities. Given its role in providing essential technical and facility management services, the organization plays a part in maintaining the operational stability of the businesses it serves.

Analysis and potential implications

LockBit is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. The group is known for its ability to maintain recurring operations despite various infrastructure disruptions. The persistence of such groups poses a significant challenge to organizations globally, as they utilize sophisticated models to facilitate attacks for various affiliates.

If the data breach is confirmed and data is leaked, the company may face regulatory obligations under the General Data Protection Regulation (GDPR), given its operations in Italy. Such incidents often trigger mandatory notification requirements to both regulatory authorities and the affected individuals. Beyond regulatory consequences, potential secondary risks include the misuse of employee or customer information and the execution of targeted phishing campaigns against the organization's stakeholders.

Based on the group's history, the publication of data could negatively impact the organization's reputation. For companies in the technology and technical services sector, maintaining trust is paramount. Organizations facing such threats generally focus on robust incident response plans, continuous monitoring, and implementing strict access controls to mitigate the impact of potential breaches. Protecting the integrity of technical services and facility management operations is critical to ensuring the continuity of the business and its clients' operations.