LockBit5 claims data breach against chooseultimate.com

• Ransomware group: LockBit5
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: October 19, 2026

LockBit5 claims a data breach at chooseultimate.com

The ransomware group known as LockBit5 has officially listed chooseultimate.com on its dedicated leak site. Through this announcement, the group has made a claim regarding a data breach involving the organization. This development follows a pattern often observed in modern cyberattacks, where threat actors use public-facing leak sites to pressure victims by threatening the release of sensitive information.

Details of the alleged attack

According to the announcement made on October 19, 2026, the LockBit5 group has added chooseultimate.com to its list of victims. The group has reportedly set a deadline of November 3, 2026, during which they have threatened to publish the institution's data if their demands are not met. To support their claim of a successful intrusion, the group has displayed various document samples on the leak page as visual evidence.

These displayed samples include various forms and spreadsheet-like files that allegedly belong to the organization. The presence of such files on a leak site is a common tactic used by ransomware groups to demonstrate the legitimacy of their breach and to increase the pressure on the target entity.

Affected data types

Based on the information provided by the group on their leak site, the following types of data are claimed to have been compromised:

• Corporate documents
• Forms

While the group has provided visual evidence through screenshots of these documents, the specific volume of data and the exact file counts have not been disclosed in the announcement.

About the organization

Ultimate Health Plans is a health insurance organization based in Spring Hill, Florida. The entity provides health insurance services to local communities and offers Medicare Advantage plans to its members.

Analysis and potential impact

This alleged breach may pose a significant risk of exposing sensitive personal information, given that the institution provides Medicare Advantage Plans. Because the organization is a US-based entity, this incident could trigger legal obligations under HIPAA regulations. The potential publication of such data could lead to identity theft and targeted phishing attacks against the institution's members.

Given the historical behavior of the LockBit5 group, it is assessed that they may be employing double-extortion tactics. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the data publicly, the attackers aim to force the victim into paying a ransom to prevent the exposure of confidential records.

When organizations in the healthcare and insurance sectors face such threats, it is critical to review data security protocols. Defensive measures often include implementing robust encryption, maintaining strict access controls, and conducting regular security audits. Furthermore, if a breach is confirmed, organizations may need to follow regulatory guidelines regarding the notification of affected parties to mitigate harm and comply with legal requirements.