Lockbit5 ransomware group lists hollandbulbfarms.com on its leak site

• Ransomware group: Lockbit5
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: June 11, 2026

The LockBit5 ransomware group has officially listed hollandbulbfarms.com on its dedicated data leak site. This announcement follows a claim by the threat actor that the organization has been targeted in a cyberattack, potentially exposing sensitive information.

The details of the claim

According to the announcement made on the group's leak site on June 11, 2026, the organization was allegedly subjected to a cyberattack on May 19, 2026. The threat actor group continues to carry out its operations by threatening to publish the organization's data to exert pressure.

Ransomware groups often utilize leak sites to host information stolen during an intrusion. These sites serve as a public platform for the attackers to demonstrate their success and pressure victims into paying ransoms. This specific incident involves a claim of a data breach rather than a simple encryption event, indicating that the attackers are focusing on the theft of information.

Information regarding the alleged breach

At this stage, no details regarding the nature of the allegedly leaked data have been shared by the group. The information provided by the threat actor consists of a screenshot that belongs to a general monitoring platform rather than specific evidence of the stolen files.

• No specific data types have been identified in the listing.

In many modern ransomware campaigns, attackers employ a method known as double extortion. In this scenario, the threat actor does not just encrypt the victim's systems to disrupt operations; they also exfiltrate sensitive data. The threat of releasing this data publicly serves as a secondary lever to force the victim to comply with ransom demands, even if the victim has robust backups to restore their systems.

About hollandbulbfarms.com

Holland Bulb Farms is an online retail store specializing in flower bulbs, rhizomes, and seedlings. The organization focuses on providing gardening products and various plant cultivation materials to its customers.

Implications and security considerations

This claim suggests that the organization's customer data and commercial information may be at risk. Because the organization is based in the United States, a potential data breach could trigger investigations under state-level data protection laws and regulatory bodies.

LockBit is a ransomware actor that has been monitored since 2019. The group is known for its persistence and has been reported to have returned with a new version after its infrastructure was disrupted in February 2024. The ability of such groups to re-emerge highlights the ongoing challenge they pose to global cybersecurity defenses.

For organizations operating in the agriculture and food production sector, such incidents underscore the importance of robust data protection strategies. The potential publication of data through double extortion methods may result in negative impacts on corporate reputation. Furthermore, customers of the organization should remain cautious against identity theft or targeted phishing attacks that often follow such breaches.

Defensive measures for organizations typically involve implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to prevent initial access through social engineering. Monitoring for unauthorized data exfiltration is also a critical component of a modern security posture to mitigate the impact of such claims.