Lockbit5 ransomware group lists mostykatowice.pl on its leak site

• Ransomware group: Lockbit5
• Country: Poland
• Announcement date: December 26, 2025

Lockbit5 claims data breach at mostykatowice.pl

The Lockbit5 ransomware group has listed the Polish organization mostykatowice.pl on its dedicated leak site. In an announcement posted on December 26, 2025, the threat actor group alleged that they have successfully exfiltrated data from the entity. This listing follows a claimed attack date of May 8, 2025, marking a significant development in the ongoing threat landscape facing infrastructure-related firms in the region.

Ransomware groups often utilize leak sites to exert pressure on their targets through a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. By threatening to release this stolen data publicly, the group aims to coerce the victim into paying a ransom to prevent the exposure of proprietary or personal information. Such tactics are designed to maximize the leverage held by the cybercriminals during negotiations.

Details of the alleged incident

According to the announcement made by the Lockbit5 group, the target is described as a player in the project market. The group's post on their leak site serves as the primary source for the claim that a data breach has occurred. However, specific details regarding the technical nature of the intrusion or the exact method of exfiltration have not been provided in the available documentation.

Regarding the specific content of the breach, the listing names no data types. There is no information available in the provided records or screenshots concerning the specific nature of the allegedly leaked data, nor is there information regarding the volume of files or the total size of the data exfiltrated. Furthermore, no ransom demand has been specified in the announcement.

About mostykatowice.pl

Mosty Katowice is a leading engineering and design company based in Poland. The firm specializes in bridge and road infrastructure projects, playing a significant role in the development of transportation networks. The company provides a wide range of services, including comprehensive design, consulting, and technical supervision for various transportation infrastructure projects.

Potential risks and organizational implications

The claim made by the Lockbit5 group may pose a risk to the operational continuity of mostykatowice.pl. Because the organization is involved in critical infrastructure projects, the integrity and confidentiality of its data are paramount. The allegedly exfiltrated data could potentially include corporate projects or employee information, which could have significant implications for the firm's business operations and reputation.

Furthermore, as the organization operates within Poland, a potential data breach may lead to legal sanctions under the GDPR (EU General Data Protection Regulation). Regulations such as the GDPR impose strict requirements on how organizations handle and protect personal data, and failures in data protection can result in substantial regulatory scrutiny and fines. Given the historical methods employed by the Lockbit group, there is a risk of secondary extortion attempts or the public release of data.

In response to such claims, it is often advisable for organizations to initiate a comprehensive forensic investigation within their internal networks to verify the breach claims. Such investigations are essential for determining the scope of an incident, identifying the point of entry, and ensuring that the threat has been fully remediated. Defensive measures typically include strengthening network monitoring, implementing strict access controls, and ensuring robust backup protocols are in place to mitigate the impact of future incidents.