Lockbit5 ransomware group lists fortishealthcare.com on its leak site

• Ransomware group: Lockbit5
• Country: India
• Sector: Healthcare
• Announcement date: December 31, 2025

LockBit5 claims data breach at fortishealthcare.com

The LockBit5 ransomware group has listed the domain fortishealthcare.com on its leak platform, alleging that a data breach has occurred. The group officially announced its claim regarding the institution on December 31, 2025. This development follows an alleged attack date of October 28, 2024, according to the information provided by the threat actor.

LockBit5 is a known ransomware group that has been observed in the cyber threat landscape since 2019. Following a disruption of its infrastructure in February 2024, the group reportedly returned with a new version of its operations. The group's presence on leak sites is a common tactic used to pressure victims by threatening the public release of stolen information.

Details of the alleged leak

At this stage, the specific details regarding the nature of the allegedly leaked data have not been shared by the threat actors. No information has been provided concerning the total volume of data or the specific number of files involved in the incident. Furthermore, no ransom demand has been disclosed in the current listing.

The evidence provided by the group consists of a screenshot showing a general interface. This interface appears to display the queue for the group's leak platform, rather than providing direct evidence of the specific contents stolen from the target.

About Fortis Healthcare

Fortis Healthcare is a leading private healthcare provider based in India. The company offers a wide range of medical services through its extensive network of hospitals and diagnostic centers.

Analysis and potential implications

The involvement of a major healthcare provider in a ransomware incident carries significant implications. Because the organization operates within the healthcare sector, the sensitivity of potentially leaked data poses substantial risks. The exposure of personal health records could jeopardize patient privacy and potentially lead to secondary risks, such as identity theft.

Furthermore, the institution may face legal obligations within the framework of data protection regulations in India. Given the established methods of the LockBit group, it is possible that they may employ a double extortion strategy. In such scenarios, attackers pressure an institution through the threat of publishing sensitive data or by making direct ransom demands.

The incident may lead to negative impacts on the institution's operational continuity and its reputation management. In general, organizations facing such threats often focus on strengthening their defensive postures, such as implementing robust backup solutions, enhancing network monitoring, and conducting regular security audits to mitigate the impact of future attacks.