Lockbit5 claims data breach against itgsolutions.com

• Ransomware group: Lockbit5
• Country: Jordan
• Sector: Technology
• Announcement date: December 26, 2025

Lockbit5 lists itgsolutions.com on leak site

The Lockbit5 ransomware group has published an announcement on its leak site claiming that data belonging to itgsolutions.com has been compromised. The threat actor has listed the technology solutions provider as a victim, alleging that a breach has occurred. This claim follows the group's established pattern of using leak sites to pressure organizations by threatening the public release of stolen information.

Details of the claimed attack

According to the announcement published on December 26, 2025, the group claims the attack took place on December 20, 2025. The post notes that the organization provides technology solutions for the education and government sectors, implying that the stolen data may have implications for these specific industries. The group has set a deadline of January 15, 2026, for the potential release of the data if their demands are not met.

Regarding the specifics of the breach, the announcement provided no specific details regarding the content of the leaked data. The listing names no specific data types that were allegedly stolen during the incident.

About itgsolutions.com

Integrated Technology Group (ITG) is a Jordan-based technology company. The organization provides software solutions and digital transformation services for the education, government, and corporate sectors. ITG specializes in education management systems and e-government solutions, positioning itself as a key provider of digital infrastructure for public and educational institutions.

Analysis and industry implications

Given that the organization provides software solutions for the education and government sectors, a potential data breach could expose sensitive corporate information and user data. This situation may lead to a loss of trust among the organization's clients and potentially trigger secondary attacks. The past activities of the Lockbit group suggest that leaked data could be utilized for identity theft or targeted phishing campaigns. As the organization is based in Jordan, local data protection regulations may need to be considered in the event of a breach.

Threat actor assessment

The threat actor maintains its operational capacity, as evidenced by its continued activity and infrastructure updates. The group has been active since 2019, and its ability to target specialized technology providers remains a significant concern for the sector. Ransomware groups often employ double extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations.

Defensive considerations for the sector

Organizations operating in the technology, education, and government sectors should consider several defensive measures to mitigate the risks posed by such threats. Implementing robust data encryption for both at-rest and in-transit data can help protect sensitive information even if a perimeter is breached. Furthermore, maintaining strict access controls and multi-factor authentication can reduce the likelihood of unauthorized entry into critical systems. Regular security audits and monitoring of network traffic can assist in the early detection of suspicious activities that may indicate an ongoing intrusion.