Lockbit5 claims data breach against csd-drancy.com

• Ransomware group: Lockbit5
• Country: France
• Sector: Healthcare
• Announcement date: December 26, 2025

Lockbit5 claims data breach against csd-drancy.com

The Lockbit5 ransomware group has listed the healthcare entity csd-drancy.com on its leak site, alleging that a data breach has occurred. This announcement, made on December 26, 2025, follows a claimed attack date of April 25, 2025. While the group has publicly identified the organization as a victim, the specific details regarding the scope and nature of the alleged compromise remain unverified and limited to the group's claims.

Details of the alleged attack

The Lockbit5 group is a known ransomware formation that has been tracked by security researchers since 2019. The group has a history of evolving its tactics, including an update to its infrastructure reported in February 2024. In this latest instance, the group has posted the name of the French institution on its platform, asserting that the organization's data has been compromised.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten the victim with public exposure. This pressure is intended to coerce the organization into paying a ransom to prevent the release of stolen information. When a group lists a victim, they often provide a screenshot of a queue for accessing their platform, which is what has been observed in this case.

Information regarding the leaked data

Despite the claims made by the Lockbit5 group, there is currently no information available regarding the specific nature or content of the leaked data. The group has not shared details concerning the volume of files or the total size of the data allegedly stolen during the incident. Furthermore, no specific ransom demand has been disclosed in the current listing.

The listing names no specific data types that have been compromised.

Organization profile

The target of this alleged attack is the Centre de Santé Dentaire Drancy. This institution is a dental health center located in Drancy, France. The center is dedicated to providing various dental treatment and care services to its patients.

Potential impact and sector risks

Given that the institution operates within the healthcare sector, a potential data breach poses significant risks to patient privacy and the security of sensitive personal information. Healthcare organizations are frequent targets for cybercriminals due to the high value of medical records on the dark web. If the data is indeed leaked, secondary risks could emerge, such as identity theft or targeted phishing attacks directed specifically at the patients of the center.

Because the institution is based in France, any confirmed breach involving personal data may trigger legal consequences under the General Data Protection Regulation (GDPR). Organizations operating in this sector must be aware of the stringent requirements for protecting sensitive health information and the mandatory notification protocols required by European law in the event of a compromise.

Furthermore, considering the historical methods and operational patterns of the Lockbit5 group, it is assessed that the institution's operational continuity may be affected by such an attack. When ransomware strikes a medical facility, the disruption of digital systems can impede the ability to provide essential care and manage patient appointments. To defend against such threats, organizations in the healthcare sector typically implement defensive measures such as robust backup strategies, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized access before data can be exfiltrated.