Lockbit5 claims data breach against gursoygrup.com.tr

• Ransomware group: Lockbit5
• Country: Türkiye
• Sector: Professional Services
• Announcement date: May 1, 2026

Lockbit5 claims data breach against gursoygrup.com.tr

The Lockbit5 ransomware group has claimed to have leaked data belonging to gursoygrup.com.tr on its dedicated leak site. The threat actor's announcement indicates that the organization's information has been targeted in a recent cyberattack, potentially exposing sensitive corporate or personal data.

Details of the alleged attack

According to the announcement posted on the group's leak platform on May 1, 2026, the threat actors allege that they successfully gained access to the networks of gursoygrup.com.tr on March 27, 2026. This timeline suggests that the attackers maintained presence within the network for several weeks prior to the public announcement.

Following the initial claim, the group has initiated a countdown process. In the context of ransomware operations, such countdowns are a common psychological tactic used by threat actors to pressure victims into meeting ransom demands by threatening the imminent publication of stolen information on the public internet.

Information regarding the leaked data

At this stage, no specific details regarding the content of the allegedly leaked data have been shared. The information provided by the group does not include a list of specific data types or files that have been compromised.

• The listing names no specific data types.

Because the group has not provided a detailed inventory of the stolen files, the exact scope of the breach remains unconfirmed. No specific information regarding the total size of the data or the total number of files involved has been disclosed by the attackers.

About gursoygrup.com.tr

Gürsoy Grup is a well-established Turkish holding company operating in construction, restoration, energy, tourism, and service sectors. It is particularly known for its expertise in historical restoration and large-scale infrastructure projects.

Analysis and potential implications

Lockbit5 is a known threat actor that has been active since 2019, operating under the Ransomware-as-a-Service (RaaS) model. This model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks. The group's past activities indicate that they frequently employ double extortion tactics. In a double extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure on the victim to pay.

The leakage of the organization's data may lead to secondary risks such as the exposure of employee and customer information. Given that the organization is based in Turkey, it is likely that data breach notification obligations under the KVKK may arise. Furthermore, there is a possibility that the leaked data could be utilized for identity theft or targeted phishing attacks against the organization or its stakeholders.

For organizations operating in the professional services and infrastructure sectors, maintaining robust security postures is critical. Common defensive steps include implementing multi-factor authentication across all remote access points, maintaining regular offline backups of critical data, and conducting continuous monitoring of network traffic to detect unauthorized access. Furthermore, ensuring compliance with regional data protection regulations is essential for managing the legal risks associated with potential information exposure.