Lockbit5 claims data breach at gob.mx

• Ransomware group: Lockbit5
• Country: Mexico
• Sector: Government & Defense
• Announcement date: January 21, 2026

LockBit5 targets Mexican government entity gob.mx

The LockBit5 ransomware group has listed the Mexico-based government entity gob.mx on its leak site. This announcement marks a significant targeting of a public sector institution by the ransomware-as-a-service group.

Details of the claimed attack

According to an announcement published on January 21, 2026, the LockBit group claims to have targeted the gob.mx entity. The listing indicates that activities directed at the organization's network occurred on November 15, 2024. This suggests that the threat actors may have maintained presence within the network for a significant period before the public announcement was made.

The group has established a deadline for the potential publication of the allegedly exfiltrated data. This deadline is set for February 5, 2026. Such tactics are common in ransomware operations, where threat actors use countdown timers to pressure organizations into meeting ransom demands to prevent the public release of sensitive information.

Data involvement and scope

Regarding the specifics of the breach, there is no information provided in the listing or the registration records regarding the nature of the data allegedly exfiltrated. The listing names no specific data types.

About Sociedad Hipotecaria Federal

The targeted organization, gob.mx, is associated with Sociedad Hipotecaria Federal. This entity is a development bank owned by the Mexican government. It focuses on financing the housing sector to support the development of the housing market.

Analysis and implications

This incident highlights the potential risks associated with cyberattacks against government institutions. Given the entity's role within the government sector, it is considered that the exfiltrated data could have negative implications for public security and administrative processes. The organization may face legal responsibilities under Mexican data protection regulations. Furthermore, there is a risk that the leaked data could be utilized for identity theft or targeted phishing campaigns.

LockBit is a ransomware-as-a-service (RaaS) group active since 2019. Although its infrastructure faced disruptions in February 2024, it is reported that the group continues its operations with new versions. Ransomware-as-a-service models allow developers to lease their malicious software to affiliates, who then carry out the actual attacks, making the ecosystem highly scalable and resilient to law enforcement actions.

In such scenarios, organizations typically face the challenge of double extortion, where attackers not only encrypt files but also threaten to leak sensitive information to damage the victim's reputation. For government entities, the stakes are particularly high due to the sensitive nature of the administrative and public data they manage. Defensive strategies for organizations in this sector often involve implementing robust network segmentation, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by groups like LockBit5.