Kraslice.cz listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Czechia
• Sector: Government & Defense
• Announcement date: December 26, 2025

The LockBit5 ransomware group has listed the Czech-based entity kraslice.cz on its dedicated leak site. This announcement, posted on December 26, 2025, marks a new development in the group's ongoing activities targeting various organizations.

The claim by LockBit5

According to the announcement made on the group's leak portal, LockBit5 claims to have successfully compromised data belonging to kraslice.cz. The group's listing includes the organization's contact details and physical address, providing a public identifier for the target. While the group has a documented history of activity dating back to 2019, they have not disclosed a specific ransom demand or the total volume of the data they claim to have acquired.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. By publishing the names of targeted organizations, these groups aim to damage the reputation of the victim and coerce them into paying a ransom. This tactic is a central component of modern cyber extortion, where the threat of public exposure is used as leverage against the target entity.

Data involvement and details

Regarding the specifics of the alleged breach, the group has not provided any details or sample files regarding the content of the leaked data. Furthermore, the listing does not specify the number of files involved or the total size of the data set. At this time, the listing names no specific data types.

In many ransomware attacks, threat actors employ a strategy known as double extortion. In this scenario, the attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat of leaking this stolen data on a public forum adds a layer of psychological and legal pressure on the victim, as the exposure of sensitive information can lead to long-term consequences that persist even if systems are restored from backups.

The organization profile

The target of this alleged attack, kraslice.cz, is the Kraslice Municipal Office. This entity serves as a local government authority located within the Karlovy Vary region of the Czech Republic. As a municipal body, the office is responsible for managing the city's administrative affairs, overseeing public services, and conducting various local governance activities for the community.

Implications and sector risks

Because the affected entity is a public institution, a potential data breach carries significant implications. The exposure of sensitive information could lead to the leakage of citizens' personal information. Such an event may result in administrative sanctions under the General Data Protection Regulation (GDPR) as well as local Czech data protection regulations. Beyond legal and regulatory consequences, secondary risks such as identity theft or targeted phishing attacks may emerge for both the staff of the municipality and the citizens it serves.

For organizations operating within the government and defense sector, these types of incidents highlight the critical importance of robust cybersecurity frameworks. Protecting public infrastructure and citizen data requires a multi-layered defense strategy. Common defensive steps for organizations in this sector include implementing strict access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized exfiltration. Additionally, comprehensive incident response plans are essential to mitigate the impact of a breach and to manage the complex legal and communicative requirements that follow a public disclosure of a data leak.