Lockbit5 ransomware group lists autoservizilocatelli.it on its leak site

• Ransomware group: Lockbit5
• Country: Italy
• Sector: Transportation
• Announcement date: February 7, 2026

The LockBit ransomware group has listed the Italian transportation company autoservizilocatelli.it on its dedicated leak site, claiming that the organization has been the victim of a data breach. This announcement, which was discovered on February 7, 2026, marks the latest activity by the group targeting a specific corporate entity.

Details of the claimed attack

According to the announcement posted by the threat actor, the breach is not a recent occurrence but stems from an earlier intrusion. The group cites January 25, 2026, as the date the attack took place. By listing the organization on their public platform, the group claims to have successfully gained access to the institution's internal systems.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information on the internet if a ransom is not paid. This tactic places immense pressure on the victim by threatening their reputation and legal standing. While the listing serves as a public claim of successful infiltration, the actual extent of the breach remains to be verified through independent investigation.

Information regarding the leaked data

At this stage, there is no information regarding the nature of the data allegedly leaked by the group. The evidence provided by the attackers consists of a screenshot that displays an anti-DDoS protection page, which does not provide any concrete evidence regarding the actual content of the data or the specific files that may have been accessed.

• The listing names no specific data types.

The lack of specific details regarding the file types or the volume of data is a common occurrence in the early stages of a leak site announcement. Without a detailed inventory of the stolen assets, it is difficult to determine the exact scope of the compromise.

About autoservizi locatelli

Autoservizi Locatelli is a transportation company based in the Bergamo region of Italy. The company provides reliable and comprehensive passenger transport services throughout the area, serving as a key provider of mobility solutions within its local jurisdiction.

Risk assessment and organizational implications

In the event of a successful data breach, there may be a significant risk of exposure for both employee and customer information. Because the institution is based in Italy, any confirmed breach could lead to serious legal sanctions and mandatory notification requirements under the General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict protocols regarding the handling of personal data to avoid these regulatory consequences.

Given the historical activities of the LockBit group, it is possible that any leaked data could be utilized for secondary attacks or identity theft. This secondary exploitation is a common trend in modern cybercrime, where stolen credentials or personal details are sold on illicit markets or used to launch further targeted phishing campaigns against the original victims or their clients.

Furthermore, the institution may face significant operational disruptions and reputational damage. LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. It is notable that the group returned with a new version of its malware after its infrastructure was disrupted in February 2024, demonstrating a high level of persistence and evolution in the threat landscape.

To mitigate such risks, organizations in the transportation and service sectors can implement various defensive measures. These include robust multi-factor authentication, regular security awareness training for employees, and comprehensive monitoring of network traffic to detect unauthorized access. Maintaining a strong incident response plan and ensuring regular, offline backups are also essential components of a modern cybersecurity posture.