Lockbit5 ransomware group lists merlo.de on its leak site

• Ransomware group: Lockbit5
• Country: Germany
• Sector: Manufacturing
• Announcement date: April 26, 2026

LockBit claims a data breach against Merlo Deutschland

The LockBit ransomware group has listed the German-based manufacturing company merlo.de on its dedicated leak site. This announcement, which was discovered on April 26, 2026, marks a significant development in the ongoing threat landscape involving high-profile ransomware actors. The group has officially claimed that a data breach has occurred within the organization, threatening to publish the institution's data if their demands are not met.

Ransomware leak sites serve as a primary tool for cybercriminal groups to exert pressure on their victims. In these scenarios, attackers often employ a tactic known as double extortion. This method involves not only encrypting an organization's internal systems to disrupt operations but also exfiltrating sensitive information. By threatening to release this stolen data on a public platform, the attackers aim to maximize leverage, using the threat of reputational damage and regulatory scrutiny to coerce the victim into paying a ransom.

Details of the alleged attack

According to the information provided by the ransomware group, the attack on merlo.de is alleged to have taken place on April 16, 2026. This indicates that the attackers may have had access to the network for approximately ten days before the incident was officially announced on the leak site. The group has not provided specific details regarding the nature or volume of the allegedly leaked data. The available evidence provided by the attackers consists only of a screenshot displaying a generic ransomware monitoring portal interface, which offers no insight into the specific files or databases that may have been compromised.

The listing names no specific data types that have been targeted or stolen during the incident.

About Merlo Deutschland

Merlo Deutschland is the German subsidiary of the Italian company Merlo S.p.A. The organization specializes in the distribution and servicing of telescopic handlers as well as various construction and agricultural machinery. As a provider of professional-grade heavy equipment and related technical services, the company plays a role in the industrial and agricultural supply chains.

Risk assessment and industry implications

This situation indicates that corporate data and commercial information at merlo.de may be at risk of exposure. Because the institution operates within Germany, a potential data breach could lead to legal sanctions under the General Data Protection Regulation (GDPR). Such regulatory frameworks impose strict requirements on how organizations handle and protect personal data, and failures in security can result in significant legal and financial consequences.

Given the established methods of the LockBit group, the publication of data may lead to secondary risks such as identity theft or supply chain attacks. For an organization operating in the manufacturing sector, the implications of a breach can be particularly severe. Such incidents may result in operational disruption and the loss of intellectual property, both of which are critical to maintaining a competitive advantage in industrial markets.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is notable that the group has reportedly returned with a new version following the disruption of its infrastructure in February 2024. The persistence of such groups highlights the ongoing challenge faced by industrial organizations to defend against evolving ransomware threats. To mitigate these risks, organizations typically focus on robust security measures, such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.