Lockbit5 ransomware group lists fortrex.hu on its leak site

• Ransomware group: Lockbit5
• Country: Hungary
• Sector: Technology
• Announcement date: December 26, 2025

Lockbit5 claims data breach against Fortrex Zrt.

The Lockbit5 ransomware group has listed the domain fortrex.hu on its leak platform, alleging that it has compromised the organization's data. This listing was discovered on December 26, 2025. According to the group's announcement, the alleged attack took place on April 29, 2025. This development marks a significant development for the targeted entity, as the group claims to have successfully accessed sensitive information during the intrusion.

Ransomware leak sites function as a public pressure tactic used by cybercriminal groups. In these scenarios, attackers often employ a strategy known as double extortion. In a double extortion scheme, the threat actors do not merely encrypt an organization's local files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The group then threatens to release this stolen information on their public leak site if the ransom demands are not met. This tactic increases the pressure on the victim, as the threat of public exposure can lead to severe reputational damage and legal consequences.

Details of the claimed incident

The Lockbit5 group has made specific claims regarding the nature of the breach, asserting that they have gained access to data related to the organization's industrial design and maintenance processes. While the group has posted the target on its platform, the specific contents of the stolen files remain unclear. No detailed information regarding the content of the leaked data has been provided; the available screenshot only displays the group's redirection page.

The listing names no specific data types in a detailed list.

The target organization

Fortrex Zrt. is a Hungary-based engineering company. The organization provides a variety of smart solutions within the technology sector, specifically focusing on industrial design, construction, maintenance, and the supply of spare parts. Given its role in providing engineering and maintenance solutions, the company operates within a technical environment where operational data is critical to its service delivery.

Analysis and potential implications

This incident suggests that the organization may face the risk of exposure regarding its operational data and industrial processes. Because the organization is based in Hungary, a potential data breach could trigger legal obligations under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the EU must adhere to strict protocols regarding the protection of personal and operational data, and a breach of this nature often necessitates formal reporting to regulatory authorities.

Lockbit5 is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Following infrastructure disruptions in February 2024, the group reportedly resumed operations with a new version of its malware. Given the past activities of the Lockbit group, it is possible that the leaked data could be utilized in secondary attacks or targeted phishing campaigns. In such cases, stolen information is used to craft highly convincing messages to deceive employees or clients, further expanding the scope of the initial breach.

For organizations in the technology and engineering sectors, this event highlights the necessity of monitoring post-breach processes closely. Defensive strategies typically involve robust backup management, network segmentation to prevent lateral movement, and continuous monitoring of data egress to detect unauthorized transfers. As ransomware actors continue to evolve their tactics, maintaining a high state of readiness for both data encryption and data exfiltration remains a critical priority for modern cybersecurity programs.