Lockbit5 ransomware group lists drogales.com.br on its leak site

• Ransomware group: Lockbit5
• Country: Brazil
• Sector: Retail & E-Commerce
• Announcement date: December 31, 2025

The LockBit5 ransomware group has listed the Brazilian pharmacy and personal care retailer drogales.com.br on its leak site. The group claims to have compromised data belonging to the organization and has published an entry on its dedicated leak platform to announce the incident.

The details of the claim

According to the announcement made on the group's leak platform, the LockBit5 group claims to have successfully executed a cyberattack against drogales.com.br. The listing, which appears to have been created during the final days of 2025, includes a brief description of the company's business operations and provides a link to the alleged stolen data. While the group has published this entry, the specific details regarding the content of the leaked data have not been provided by the threat actors.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also threaten to release sensitive information on public platforms if a ransom is not paid. This tactic is designed to maximize pressure on the victim by threatening their reputation and legal standing. By hosting a listing on a public platform, the group aims to increase visibility and pressure the target organization.

Data involvement and implications

The listing does not specify the exact nature or volume of the data that has been allegedly compromised. Because the group has not provided specific details regarding the content of the leaked data, the exact scope of the breach remains unconfirmed. However, given the nature of the company's operations in the retail and healthcare space, the presence of personal data may be possible.

• No specific data types were named in the listing.

When organizations face such threats, common defensive steps include strengthening network segmentation, implementing robust multi-factor authentication, and maintaining regular, offline backups. Additionally, continuous monitoring of network traffic can help in the early detection of unauthorized access or data exfiltration attempts.

About drogales.com.br

Drogales is a pharmacy and perfumery chain based in Brazil. The company's business model focuses on the retail of personal care products, medicines, and various health-related items. As a provider of essential health and hygiene products, the organization maintains a significant presence in the Brazilian retail and e-commerce sector.

Risk assessment and potential consequences

This incident suggests that the company may face the risk of exposure of customer and employee data. Because the company operates in Brazil, the confirmation of such a leak could lead to legal sanctions under the LGPD (General Data Protection Law). Compliance with data protection frameworks is a critical concern for retail organizations handling sensitive consumer information.

The past activities of the LockBit5 group indicate that the leaked data could potentially be used for identity theft or targeted phishing attacks. Such secondary risks pose a continuous threat to the individuals whose information may have been exposed. Furthermore, the incident may have negative impacts on the company's commercial reputation and could create secondary risks for its supply chain partners.

For companies in the retail and healthcare sectors, maintaining high standards of cybersecurity is vital to protecting consumer trust. A breach of this nature can lead to a loss of confidence among customers and can disrupt the operational continuity of the entire supply chain. Organizations must remain vigilant against the evolving tactics used by ransomware groups to mitigate these multifaceted risks.