Lockbit5 ransomware group lists ambisig.com on its leak site

• Ransomware group: Lockbit5
• Country: Portugal
• Sector: Technology
• Announcement date: December 26, 2025

The Lockbit5 ransomware group has announced that it has listed data belonging to ambisig.com on its leak site. This announcement, which appeared on the group's platform, marks a significant development in the ongoing targeting of technology service providers by ransomware actors.

The details of the claim

According to the announcement made by the Lockbit5 ransomware group, the organization ambisig.com has been targeted. The entry was created on December 25, 2025, and the group has indicated that the organization operates within the technology sector. Following the initial listing, the group has initiated a countdown process for the publication of the data belonging to the organization.

Ransomware groups often utilize these countdown timers as a psychological pressure tactic in what is known as double extortion. In such scenarios, attackers not only encrypt an organization's systems but also threaten to release sensitive information on public leak sites if a ransom is not paid. This method aims to maximize the leverage held by the threat actors by threatening the victim's reputation and regulatory standing.

Data involved in the incident

Regarding the specifics of the alleged breach, no details regarding the nature or content of the allegedly leaked data have been shared in the announcement. The listing does not provide information regarding the volume of files or the specific types of data that have been compromised.

About ambisig.com

Ambisig is a technology company that provides smart information management solutions for local governments and businesses. It operates primarily in the fields of digital transformation and software development for the public sector.

Analysis and potential implications

This announcement by the Lockbit group suggests that unauthorized access to the organization's network may have been achieved. Given the profile of the organization, several critical risks emerge from this development. Because Ambisig provides digital tools and software development services to local governments and businesses, the leak may pose significant supply chain risks. When a service provider for the public sector is compromised, the integrity and security of the entire ecosystem they support can be called into question.

Furthermore, as the organization is based in Portugal, potential data leaks could lead to legal sanctions under the EU General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict protocols regarding data protection, and failures in security can result in substantial regulatory consequences. Additionally, the disclosure of sensitive information belonging to the organization's clients could create a basis for identity theft and targeted phishing attacks against those clients.

The Lockbit group is a Ransomware-as-a-Service (RaaS) model that has been monitored since 2019. It is reported that the group returned with a new version after its infrastructure was disrupted in February 2024. This resilience highlights the ongoing threat posed by sophisticated ransomware operations that adapt to law enforcement actions.

For organizations in the technology and public sector service industries, maintaining robust security postures is essential. This includes implementing strict access controls, continuous monitoring for unauthorized network activity, and comprehensive incident response plans to mitigate the impact of supply chain compromises.