Lockbit5 claims data breach against orekait.com

• Ransomware group: Lockbit5
• Country: Japan
• Sector: Technology
• Announcement date: May 1, 2026

Lockbit5 claims data breach against orekait.com

The Lockbit5 ransomware group has announced the addition of technology services firm orekait.com to its leak site. This announcement, made on May 1, 2026, follows a claimed attack that occurred on April 26, 2026. The group has published a notice on their platform regarding the organization, claiming to have compromised the institution's data and listing it on their leak site.

Details of the claimed attack

According to the announcement published by the Lockbit5 ransomware group, the group claims to have successfully compromised the data belonging to orekait.com. The group's public leak portal displays a general interface, but the group has not yet provided specific data samples or a detailed file list to verify their claims. The notification serves as a public claim of a successful breach and data exfiltration.

Ransomware groups often utilize leak sites as a tool for double extortion. In this tactic, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data on a public platform, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of confidential information. This method increases the pressure on organizations, as the threat of a public leak can lead to significant reputational damage and regulatory scrutiny.

Information regarding the leaked data

Regarding the content of the alleged breach, there is no information provided regarding the nature of the leaked or threatened data. The screenshot provided by the group does not contain any specific file list or data samples related to the leak. Consequently, the specific types of files or the volume of data involved remain unknown at this time.

About orekait.com

Oreka IT is a Spain-based technology company specializing in SAP consulting, software development, and technology solutions. The organization provides digital transformation and system integration services, particularly for sectors such as railway and transport infrastructure. While the organization's profile indicates its headquarters are in Spain, the context of the claim involves operations in Japan.

Risk assessment and industry implications

This situation may pose risks to the institution's operational continuity and data privacy. If the allegedly leaked data includes employee or customer information, it could lead to identity theft or targeted phishing attacks. As the institution operates in Japan, legal obligations and administrative sanctions under the APPI (Act on the Protection of Personal Information) may arise.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported that they have continued their operations with a new version following the disruption of their infrastructure in February 2024. The persistence of such groups highlights the ongoing challenge they pose to global digital infrastructure.

Considering the institution's supply chain relationships, secondary victimization may also be observed. In the technology and consulting sector, organizations often hold sensitive data belonging to their clients or partners. A breach at a service provider can create a ripple effect, potentially exposing the networks and data of various downstream clients. Organizations in this sector can mitigate such risks by implementing strict access controls, maintaining robust backup strategies, and ensuring comprehensive monitoring of their digital environments to detect unauthorized access early.