Lockbit5 ransomware group lists audiconcontadores.com.br on its leak site

• Ransomware group: Lockbit5
• Country: Brazil
• Sector: Professional Services
• Announcement date: March 30, 2026

Lockbit5 claims responsibility for data breach at Audicon Contadores

The Lockbit5 ransomware group has published a notice on its dedicated leak site, claiming to have compromised data belonging to the Brazilian professional services firm Audicon Contadores. The announcement, which appeared on the group's platform, indicates a significant breach involving the accounting and consulting firm.

Details of the claimed attack

According to the information provided by the threat actor, the group listed audiconcontadores.com.br on its leak site on March 9, 2026. The attackers claim to have successfully compromised the institution's data. In their announcement, the group has provided ten different links intended for downloading the files. The listing also includes a specific deadline, setting a date of March 24, 2026, for the group's demands or further actions.

Information regarding the leaked data

Regarding the specific content of the files allegedly stolen by the attackers, no specific details regarding the content of the leaked data have been provided; only ten download links are available. The listing names no specific data types or file counts.

About Audicon Contadores

Audicon Contadores is a Brazil-based accounting and consulting firm. It provides professional services such as financial reporting, tax compliance, and management consulting to businesses.

Analysis and potential implications

The Lockbit group is a Ransomware-as-a-Service (RaaS) entity that has been active since 2019. In such operations, the group provides the ransomware infrastructure to affiliates who carry out the actual attacks, allowing the group to scale its operations. The potential exposure of the institution's data may lead to the disclosure of client financial information and trade secrets. Given the nature of the professional services sector, such a leak can be highly damaging to the trust between the firm and its corporate clients.

As the firm operates in Brazil, the incident may result in legal consequences under the LGPD (General Data Protection Law). Data protection regulations in many jurisdictions require organizations to implement robust security measures and report breaches to authorities to protect individual privacy. Furthermore, the leaked data could be utilized for targeted phishing attacks or identity theft attempts against the institution's clients. Threat actors often use stolen corporate data to craft highly convincing social engineering campaigns, making them more effective at deceiving employees or clients.

Given the group's history, it is possible that they are attempting to increase pressure on the institution through double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt the victim's data to disrupt operations but also steal sensitive information to threaten its public release. This method is designed to force payment even if the organization has backups to restore their systems. To defend against such threats, organizations in the professional services sector often implement multi-layered security strategies, including regular offline backups, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration.