Lockbit5 claims data breach against grupotersa.com.mx

• Ransomware group: Lockbit5
• Country: Mexico
• Sector: Manufacturing
• Announcement date: December 7, 2025

The LockBit5 ransomware group has listed the Mexican entity grupotersa.com.mx on its dedicated leak site, alleging that a data breach has occurred. This announcement, posted on December 7, 2025, marks a new development in the group's ongoing targeting of various organizations across different sectors.

The details of the claim

According to the announcement made by the LockBit5 group, the organization grupotersa.com.mx has been targeted in a cyberattack. While the group has officially listed the company on its leak portal, the specific details regarding the mechanics of the intrusion remain undisclosed. Notably, the group has referenced March 15, 2025, as a relevant date associated with the incident.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly if a ransom is not paid. By listing a company on a public portal, the threat actor aims to damage the victim's reputation and create urgency through the threat of exposure.

Information regarding the alleged data breach

Despite the public listing of the organization, the announcement provided by the LockBit5 group is notably lacking in specific details. There are no details or file samples provided in the announcement regarding the nature of the allegedly leaked data. Furthermore, the group has not disclosed the total size of the data or the specific number of files involved in the incident. No ransom demand has been made public in the current announcement.

• The listing names no specific data types.

In many modern ransomware campaigns, the lack of immediate data samples can be a strategic choice by the threat actor, intended to increase uncertainty for the victim and their stakeholders. Without specific evidence or file counts, the true scope of the breach remains unverified by the public announcement alone.

About grupotersa.com.mx

Grupo TERSA is a Mexico-based group of companies operating in the automotive tires, service, logistics, and transportation sectors. It specializes in tire sales, vehicle maintenance, and fleet management services. Given its role in logistics and transportation, the organization plays a significant part in the supply chain and automotive service infrastructure within its region.

Risk assessment and organizational implications

This announcement by the LockBit group may pose a risk to the entity's operational processes. Although the content of the allegedly leaked data remains unclear, the disclosure of corporate information could negatively impact trade secrets or employee data. Such a leak can lead to significant operational disruptions and long-term reputational damage.

Furthermore, the entity may face legal obligations under Mexican data protection regulations following such an event. Beyond the immediate legal concerns, secondary risks such as targeted phishing attacks could emerge, as attackers may use any leaked corporate information to craft more convincing social engineering campaigns against employees or partners.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported to have continued its activities following an infrastructure disruption in February 2024. Organizations operating in the manufacturing and logistics sectors are often targeted by such groups due to the critical nature of their supply chain operations. To mitigate these risks, organizations typically focus on robust backup strategies, continuous monitoring, and employee awareness training to defend against the evolving tactics of RaaS operators.