Lockbit5 ransomware group lists mtspokanepediatrics.com on its leak site

• Ransomware group: Lockbit5
• Country: United States
• Sector: Healthcare
• Announcement date: January 3, 2026

Lockbit5 claims a data breach against Mt. Spokane Pediatrics

The Lockbit5 ransomware group has listed mtspokanepediatrics.com on its dedicated leak site, alleging that the organization has been the victim of a data breach. This announcement, posted on January 3, 2026, marks a new development in the group's ongoing targeting of various sectors, including healthcare.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. By publicly listing an organization, these groups aim to damage the victim's reputation and coerce them into paying a ransom. This tactic is a core component of modern cyber extortion campaigns, where the threat of public exposure is used as a primary leverage tool.

Details of the alleged attack

According to the claims made by the Lockbit5 group, the compromise of the entity associated with the domain mtspokanepediatrics.com may have occurred on December 28, 2025. The group has issued a threat to publish the organization's data if their demands are not met, setting a deadline for the organization of January 23, 2026.

The group's announcement does not specify the exact nature of the leaked or threatened data. The listing does not name any specific data types that have been compromised or are at risk of being released.

The organization profile

Mt. Spokane Pediatrics is a medical center located in Spokane, Washington. The facility provides comprehensive pediatric healthcare services, catering to a patient demographic that ranges from birth through young adulthood.

Analysis and potential implications

Given that the organization operates within the healthcare sector, the alleged breach carries significant risks regarding patient privacy and the potential exposure of sensitive health records. In the United States, healthcare providers are subject to strict regulatory frameworks, and a potential data breach of this nature may lead to significant regulatory consequences under HIPAA requirements.

The tactics employed by Lockbit5 appear to align with double extortion methods. In a double extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. The threat of leaking private information creates a secondary layer of pressure, aiming to force a ransom payment by threatening the organization's reputation and the privacy of its clients.

For healthcare entities, such incidents can lead to long-term reputational damage and expose patients to secondary risks, such as identity theft. To mitigate these risks, organizations in this sector often implement defensive measures such as robust encryption, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized access or data exfiltration attempts.

Lockbit5 is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. The group is reported to have resumed its operations with a new version following a significant infrastructure disruption that occurred in February 2024.