Lockbit5 claims data breach against Bolivian state electricity company ende.bo

• Ransomware group: Lockbit5
• Country: Bolivia
• Sector: Energy & Utilities
• Announcement date: December 7, 2025

Lockbit5 lists ende.bo on leak site

The Lockbit5 ransomware group has listed the Bolivian organization ende.bo on its dedicated leak site, alleging that the company has been the victim of a data breach. This announcement, made on December 7, 2025, follows a claimed attack date of April 4, 2025. While the group has officially claimed responsibility for the incident, the specific details regarding the breach remain limited at this stage.

The Lockbit5 group is a known ransomware entity that has been active since 2019. According to reports, the group resumed its operations with a new version of its malware in 2024. Ransomware leak sites are platforms used by cybercriminal groups to exert pressure on victims. These sites typically host stolen data to shame organizations into paying ransoms. When a group uses a leak site, they often employ a double-extortion strategy, where they not only encrypt the victim's systems but also threaten to release sensitive information publicly to maximize leverage.

Details of the alleged breach

The announcement provided by the Lockbit5 group includes a brief description of the company's operations, but it lacks specific details regarding the incident itself. Currently, there is no information provided regarding the type or the specific content of the allegedly leaked data. Additionally, the group has not provided any information regarding the total size of the data or the specific number of files involved in the incident.

Furthermore, the group has not issued a ransom demand in the current listing. The listing names no specific data types or content categories that have been targeted in this alleged breach.

About ende.bo

Empresa Nacional de Electricidad (ENDE) is the state-owned national electricity company of Bolivia. As a vital component of the nation's infrastructure, the company is responsible for the generation, transmission, and distribution of electricity throughout the entire country.

Potential risks and sector implications

The involvement of a major energy provider suggests that this breach may pose significant risks to critical infrastructure security. In the energy sector, the exposure of operational data can create secondary risks for the company's entire supply chain. Furthermore, if sensitive information is indeed exposed, it could lead to identity theft and targeted phishing attacks directed at either employees or customers of the utility provider.

Given the historical methods utilized by the Lockbit5 group, it is assessed that this breach may be part of a double-extortion strategy. Such strategies are designed to force compliance by threatening the public disclosure of sensitive organizational or personal information. Because the target operates in the energy sector, the incident carries implications for national infrastructure stability and security.

Organizations operating in critical infrastructure sectors often face complex challenges following such incidents. To mitigate risks, companies generally focus on robust data protection measures and monitoring for unauthorized access. Following a breach, organizations may also face legal obligations under the data protection regulations established within their respective countries, such as the regulations in Bolivia. Maintaining rigorous security protocols is essential for protecting both operational integrity and the privacy of stakeholders.