Lockbit5 claims data breach against occgrouptr.com

• Ransomware group: Lockbit5
• Country: Türkiye
• Sector: Professional Services
• Announcement date: December 26, 2025

Lockbit5 claims data breach against occgrouptr.com

The Lockbit5 ransomware group has listed the domain occgrouptr.com on its leak site, alleging that a data breach has occurred. This announcement, made on December 26, 2025, marks the latest claim by the group against a professional services entity. While the listing is currently active on the group's platform, the claims remain unverified assertions by the threat actor.

Details of the alleged attack

According to the claims made by the Lockbit5 group, the organization was compromised on May 6, 2025. The group asserts that the attack resulted in the exfiltration of data belonging to the organization. In such ransomware scenarios, threat actors often employ a double extortion tactic, where they not only encrypt an organization's systems but also steal sensitive information to use as leverage during ransom negotiations.

The group's announcement does not provide specific details regarding the nature of the leaked data. The evidence provided by the attackers consists of a generic waiting page, which indicates the current queue position for the group's leak platform. This type of placeholder is common on ransomware leak sites while the group prepares to release stolen information to increase pressure on the victim.

Organization profile

OCC Group is a media group that provides integrated marketing and advertising solutions by creating synergy between advertisers and media organizations. The company operates in media planning, buying, and creative advertising processes through its various subsidiaries.

Impact and security implications

The claims made by the Lockbit5 group may lead to disruptions in the organization's operational processes. If a data breach has indeed occurred, the organization may face notification obligations under the KVKK, which could trigger legal proceedings. The potential exposure of data to third parties may increase the risk of identity theft or targeted phishing for the organization's employees and clients.

Lockbit5 is known as a Ransomware-as-a-Service (RaaS) group that has been active since 2019 and has continued its operations by updating its infrastructure. Given that the organization operates in the professional services sector, the breach may also have indirect implications for supply chain security. When a service provider is compromised, the interconnected nature of modern business can allow the threat to ripple through the supply chain.

To defend against such threats, organizations typically focus on robust security frameworks. This includes maintaining rigorous patch management to close vulnerabilities, implementing multi-factor authentication to prevent unauthorized access, and conducting regular employee training to mitigate phishing risks. Furthermore, maintaining offline, immutable backups is a critical component of a resilient defense strategy against ransomware attacks.