Lockbit5 ransomware group lists casaandina.com.co on its leak site

• Ransomware group: Lockbit5
• Country: Colombia
• Sector: Hospitality
• Announcement date: June 20, 2026

LockBit5 claims data breach at Casa Andina

The LockBit5 ransomware group has listed the Colombian organization casaandina.com.co on their dedicated leak site. According to the announcement posted on June 20, 2026, the group claims to have successfully targeted the company, marking another instance of the group's ongoing extortion activities.

The group's announcement alleges that the organization was involved in a cyber incident that occurred on March 19, 2026. Through this public listing, the threat actors claim to have obtained the organization's data and have subsequently shared this information publicly. This type of activity is characteristic of modern ransomware operations, where the threat actors use public platforms to pressure victims into meeting ransom demands by threatening the exposure of sensitive information.

Details regarding the claimed data

While the group has published a leak announcement, specific details regarding the contents of the breach remain unavailable. The current information provided by the threat actors is limited, and there is no information regarding the nature of the leaked or threatened data. Furthermore, the group has not provided any information regarding the total size of the data or the specific file count involved in the incident. There is also no information regarding a specific ransom demand.

The available evidence, such as the screenshot provided by the group, only shows the entry page of the leak site and does not contain any specific data samples. Consequently, the listing names no specific data types that have been compromised.

About Casa Andina

Casa Andina is a hardware and construction material distributor operating in the southwestern region of Colombia. The company supplies various building materials for construction projects in the region, making it a key player in the local supply chain for the construction and hardware sectors.

Risk assessment and implications

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. Following a significant disruption of its infrastructure in February 2024, the group reportedly returned with a new version of its malware. The leak of the organization's data may lead to secondary risks, such as the disclosure of employee and customer information. Furthermore, the leaked data could potentially be used for identity theft or targeted phishing attacks.

From a regulatory perspective, it is possible that the organization may face legal obligations under Colombian data protection regulations due to the alleged exposure of information. Given the group's past activities and the nature of the threat, it is assessed that the organization's operational continuity may be negatively impacted by this incident.

In general, when organizations face such threats, they often deal with the complexities of double extortion, where attackers not only encrypt systems but also steal data to use as leverage. To mitigate such risks, organizations typically focus on robust backup strategies, continuous monitoring of network traffic, and comprehensive employee training to prevent initial access via phishing. Maintaining compliance with regional data protection laws is also a critical component of a modern cybersecurity posture to manage the legal ramifications of potential data exposures.