Isoledilcappotti.it listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: March 30, 2026

LockBit5 claims data exfiltration from isoledilcappotti.it

The LockBit5 ransomware group has listed the Italian organization isoledilcappotti.it on its dedicated leak site. According to the group's announcement, they have successfully exfiltrated data belonging to the company. This claim follows a pattern of double extortion, a common tactic used by modern ransomware operators where stolen data is threatened with public release to pressure victims into paying a ransom.

Details of the alleged attack

The group claims to have gained unauthorized access to the digital assets of the institution. The incident involving the alleged breach reportedly occurred on March 21, 2026. The listing itself was subsequently discovered on the group's leak site on March 30, 2026. While the group has asserted that they have compromised the organization's digital environment, the specific methods used to gain access have not been disclosed in the announcement.

Data involved in the leak

Regarding the specifics of the stolen information, the group has not provided any details concerning the content of the leaked data. No information was provided regarding the total size of the data or the specific number of files involved. However, the group has shared ten external links intended to provide access to the allegedly stolen data.

• No specific data types were named in the listing.

About isoledilcappotti.it

ISOLEDIL is an Italy-based construction and building materials supplier. The company provides various construction solutions and professional building services to its clients.

Impact and security implications

This incident may negatively impact the institution's operational continuity and customer trust. Given that the institution is based in Italy, legal sanctions under the General Data Protection Regulation (GDPR) may arise if the leaked data contains personal information. Organizations facing such risks may need to fulfill data breach notification obligations and inform affected parties.

Based on the past activities of the LockBit group, it is possible that the leaked data could be used for identity theft or targeted phishing attacks. LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. It is reported to have continued its operations with a new version following an infrastructure disruption in February 2024.

In general, when organizations face such threats, defensive measures often include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Organizations in the retail and construction supply sectors must remain vigilant against evolving ransomware tactics to protect their digital assets and maintain regulatory compliance.