Lockbit5 lists crystalcoastpm.com on leak site

• Ransomware group: Lockbit5
• Country: United States
• Sector: Healthcare
• Announcement date: February 23, 2026

Lockbit5 claims breach of crystalcoastpm.com

The Lockbit5 ransomware group has officially listed the organization crystalcoastpm.com on its dedicated leak site. This announcement marks a potential escalation in a cyberattack targeting the entity, which operates within the healthcare sector. By appearing on the group's leak portal, the organization faces the risk of public data exposure as part of the threat actor's typical operational procedures.

The listing of a target on a ransomware leak site is a common tactic used in double extortion schemes. In these scenarios, threat actors not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data. The group then threatens to release this information publicly unless a ransom is paid, leveraging the pressure of reputational damage and regulatory penalties to coerce the victim into payment.

Details of the claimed attack

According to the announcement made by the Lockbit5 group on February 23, 2026, the threat actors claim to have successfully gained unauthorized access to the systems of crystalcoastpm.com. The group asserts that this initial compromise occurred on February 3, 2026, suggesting that the attackers may have maintained presence within the network for approximately three weeks prior to the public listing.

The timing of the announcement suggests that the group may be initiating a formal ransom demand or a process of data exposure. When a group moves from the initial intrusion phase to listing a victim on a leak site, it often signals that the negotiation phase has either failed or that the attackers are moving toward the final stage of their extortion attempt.

Data and information status

At this stage, no specific details regarding the nature of the alleged leaked data have been provided by the threat actors. The information currently available is limited to the standard Lockbit 5.0 ransomware leak portal interface shown in the group's post. The listing names no specific data types or file categories that have been targeted during the alleged breach.

Because no information has been provided regarding the volume of data or the specific files involved, the full scope of the potential impact remains unknown. The absence of specific data descriptions is common in the early stages of a leak site announcement, as groups often use the initial listing as a pressure tactic before revealing more granular details about the stolen information.

Implications for the healthcare sector

This claim poses a significant risk to the confidentiality of patient records due to the organization's involvement in healthcare services. In the healthcare industry, the sensitivity of medical and personal information makes these entities prime targets for ransomware groups. A confirmed breach of such data can lead to severe consequences for both the organization and the individuals whose information is compromised.

As the entity is based in the United States, a potential data breach could trigger complex legal processes under HIPAA regulations. These regulations mandate strict protections for patient health information and require specific notification procedures in the event of a compromise. Beyond legal and regulatory challenges, secondary risks include the potential use of leaked data for identity theft or highly targeted phishing attacks against patients and staff.

Lockbit is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Following a significant disruption in February 2024, the group has reportedly resumed operations utilizing a new version of its malware. For organizations operating in this sector, such incidents underscore the necessity of reviewing data security protocols and evaluating robust notification processes for all affected parties to mitigate long-term damage.