Lockbit5 ransomware group lists acarlar.com.tr on its leak site

• Ransomware group: Lockbit5
• Country: Türkiye
• Sector: Professional Services
• Announcement date: December 26, 2025

Lockbit5 claims data breach at acarlar.com.tr

The Lockbit5 ransomware group has listed the Turkish organization acarlar.com.tr on its dedicated leak site, alleging that the company has suffered a data breach. This announcement, which appeared on the group's portal, marks a potential cyberattack against the prominent firm, though the specific nature of the breach remains to be fully understood from the available information.

The group has officially announced the compromise of acarlar.com.tr through a post on its leak portal. According to the group's claims, they have successfully compromised the organization's data. Following this announcement, the group has set a deadline of January 15, 2026, for the organization. The initial announcement was uploaded to the leak site on December 25, 2025, and the post includes general information regarding the company's business operations.

Details regarding the claimed data

While the ransomware group has claimed to have acquired sensitive information, they have not provided specific details or any sample files regarding the leaked data. At this stage, the listing does not provide information regarding the volume of data stolen or the specific types of files involved.

• No specific data types or sample files have been provided in the listing.

About Acarlar Group of Companies

Acarlar Group of Companies is a well-established Turkish firm that was founded in 1963. Based in Istanbul, the group is a significant player in several key industries. It primarily operates within the construction, real estate development, and facility management sectors. The group is particularly recognized for its involvement in luxury residential projects and the management of commercial spaces.

Potential risks and organizational implications

The potential exposure of the organization's data may pose various secondary risks. Such risks include the possibility of identity theft or the execution of targeted phishing attacks against both employees and customers. Because the organization operates within Turkey, it may be required to fulfill specific data breach notification obligations under the KVKK (Personal Data Protection Law).

The Lockbit5 group is a Ransomware-as-a-Service (RaaS) entity that has been active since 2019 and has reportedly undergone a restructuring in February 2024. Given the historical methods utilized by the Lockbit group, it is possible that the leaked data could lead to a broader breach in the future. Furthermore, the organization may face negative impacts on its commercial reputation and could experience operational disruptions as a result of this incident.

In the broader context of cybersecurity, ransomware groups often utilize double extortion tactics, where they not only encrypt an organization's data but also threaten to leak it to pressure the victim into paying a ransom. This method increases the pressure on companies to comply with demands to avoid public exposure of sensitive information. Organizations in the professional services and construction sectors often prioritize robust defensive measures, such as multi-factor authentication, regular data backups, and comprehensive employee training, to mitigate the risks of such targeted attacks.