Lockbit5 claims data breach against senai.br

• Ransomware group: Lockbit5
• Country: Brazil
• Sector: Education
• Announcement date: March 30, 2026

LockBit5 claims a data breach at senai.br

The LockBit5 ransomware group has listed the Brazilian institution senai.br on its dedicated leak site, claiming that a significant data breach has occurred. This announcement marks a new targeted attack against a major entity in the Brazilian education sector, as the threat actors have publicly claimed responsibility for the intrusion.

The details of the claimed attack

According to the announcement made by the LockBit5 group on March 30, 2026, the attackers claim to have successfully targeted senai.br. The threat actors allege that they gained unauthorized access to the institution's network as early as March 9, 2026. Following this initial intrusion, the group claims to have exfiltrated data from the organization's systems.

The group has issued threats regarding the stolen information, stating that they intend to publish the data if their demands are not met. This tactic is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt systems but also threaten to leak sensitive information to increase pressure on the victim.

Information regarding the exfiltrated data

At this stage, no specific details regarding the nature of the allegedly exfiltrated data have been provided by the threat actors. The available evidence, such as the screenshots provided by the group, displays a landing page for the Ransomware.live platform but does not offer any specific file or content samples related to the breach. Consequently, the listing names no specific data types that were allegedly stolen.

About senai.br

SENAI (Serviço Nacional de Aprendizagem Industrial) is a well-established institution in Brazil that provides vocational training and technical support for the industrial sector. It offers technical courses, professional development programs, and technological innovation services throughout the country.

Impact and security implications

This incident may threaten the operational continuity and data security of an institution operating in the education sector. The potential exposure of student and staff data could lead to secondary risks such as identity theft or targeted phishing attacks. Furthermore, under the LGPD legislation in Brazil, the institution may face data breach notification obligations and potential legal sanctions.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported that the group returned with a new version after its infrastructure was disrupted in February 2024. Given the group's past activities, it is possible that the exfiltrated data may be made public or sold to third parties if the ransom is not paid.

For organizations in the education sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Organizations must also ensure compliance with regional data protection laws to mitigate legal and reputational risks following a potential breach.