Lockbit5 claims data breach against drako.com.mx

• Ransomware group: Lockbit5
• Country: Mexico
• Sector: Technology
• Announcement date: December 26, 2025

Lockbit5 claims data breach against drako.com.mx

The Lockbit5 ransomware group has listed drako.com.mx on its leak site, alleging that the organization has suffered a data breach. This announcement, made on December 26, 2025, follows a claimed attack date of November 11, 2025. The listing suggests that the organization's data has been compromised by the threat actor group.

Details of the alleged incident

According to the information provided by the threat actor, the Lockbit5 ransomware group has published drako.com.mx on its leak platform. This group is a known ransomware operation that has been active since 2019. Records indicate that the group reportedly updated its underlying infrastructure in February 2024. The group's presence on leak sites is a common tactic used to pressure victims into paying ransoms by threatening to release sensitive information to the public.

Ransomware leak sites serve as a public gallery for cybercriminals to display their victims. When a group successfully infiltrates a network, they often employ a method known as double extortion. In this scenario, the attackers do not just encrypt the victim's files to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this data on a public website adds a layer of pressure, as the victim faces not only operational downtime but also significant reputational damage and potential legal consequences from the exposure of private information.

Data involved in the claim

Regarding the specific nature of the alleged leaked data, the current records and screenshots do not provide any information. The listing names no specific data types or files that have been compromised.

About Grupo Drako

Grupo Drako is a Mexican company that has been operating since 1962. The organization specializes in technology and industrial solutions. Throughout its long history, the company has provided services focused on innovation and leadership across various sectors.

Impact and security considerations

This situation may lead to disruptions in the organization's operational processes and the exposure of sensitive data. Because the organization operates in Mexico, the incident may trigger legal processes under the relevant data protection regulations applicable in that jurisdiction. When a breach occurs, regulatory bodies often oversee the investigation to ensure compliance with privacy laws and to protect the rights of the affected parties.

Given the Lockbit group's known double-extortion method, it is possible that the leaked data could be used for secondary attacks or identity theft. This secondary phase of an attack is particularly dangerous, as stolen credentials or personal information can be sold on illicit forums or used to facilitate further unauthorized access to other systems.

There may be a risk of targeted phishing attacks against the organization's customers and employees. In such cases, attackers use the information gathered during the initial breach to craft highly convincing messages, tricking individuals into revealing more sensitive information or installing further malware. Therefore, relevant parties may need to increase their security measures to defend against these evolving threats. Organizations in the technology and industrial sectors should focus on robust monitoring, employee awareness training, and strict access controls to mitigate the risks posed by such sophisticated ransomware operations.