Lockbit5 claims data breach against pdcm.com

• Ransomware group: Lockbit5
• Country: United States
• Sector: Financial Services
• Announcement date: December 19, 2025

The Lockbit5 ransomware group has claimed to have listed the insurance services provider pdcm.com on its dedicated leak site. According to the announcement made by the threat actor group, the organization has been targeted in a cyberattack, resulting in a data breach that has been publicized on the group's platform.

The details of the alleged attack

The incident was officially announced on the Lockbit5 leak site on December 19, 2025. According to the claims made by the ransomware group, they gained unauthorized access to the organization's data following a cyberattack that allegedly occurred on April 28, 2025. This suggests a significant gap between the initial intrusion and the public announcement of the breach.

Evidence provided by the group, including screenshots, indicates a redirection to their specific platform, which is a common tactic used by ransomware groups to demonstrate the success of their operations. While the group has taken responsibility for the listing, the claims remain unverified by independent third parties.

Information regarding the leaked data

Regarding the specific content of the breach, the group has not provided any details concerning the nature of the allegedly leaked data. There is no information available regarding the specific file types, the total number of files involved, or the total size of the data exfiltrated during the incident. Furthermore, the group has not specified a ransom demand in connection with this particular listing.

The listing names no specific data types that have been compromised.

About pdcm.com

PDCM Insurance is a financial services company that offers a range of insurance solutions. Their service portfolio includes business insurance, group insurance, and individual life and health insurance.

Analysis and industry implications

Lockbit5 is a ransomware group that has been operating since 2019. The group is widely recognized for its Ransomware-as-a-Service (RaaS) model, which allows different affiliates to conduct attacks using the group's infrastructure. It has been reported that the group resumed its operations with a new version following infrastructure disruptions that occurred in February 2024.

The group frequently employs double extortion tactics. In this model, attackers do not just encrypt an organization's systems but also steal sensitive data. They then threaten to release this data on public leak sites to exert maximum pressure on the organization to pay the ransom. This tactic significantly increases the likelihood of sensitive information being made public.

Given that the affected organization operates within the financial and insurance services sector, the leaked data may potentially contain sensitive customer personal information and financial records. Such a breach carries significant risks, including the potential for identity theft and targeted phishing attacks against the organization's customers. For the organization, the exposure of such data could lead to legal sanctions and administrative processes under US-based regulations and data privacy laws.

Organizations operating in the financial services sector often face these types of threats. To mitigate such risks, companies typically implement various defensive measures, such as robust encryption for data at rest and in transit, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized access. Maintaining a comprehensive incident response plan and ensuring regular backups are also critical components of a modern cybersecurity posture.