Lockbit5 ransomware group lists nandrin.be on its leak site

• Ransomware group: Lockbit5
• Country: Belgium
• Sector: Government & Defense
• Announcement date: March 30, 2026

LockBit claims to have targeted the municipality of Nandrin

The municipality of Nandrin, a public institution located in Belgium, has been listed on the leak site of the LockBit ransomware group. According to the announcement made by the threat actor, the group claims to have obtained data from the institution operating under the domain nandrin.be. This listing marks a significant development in the ongoing activity of the LockBit group, which has been a known entity in the cyber threat landscape since 2019.

The announcement was posted on the group's leak site on March 20, 2026. In the post, the group has set a deadline of April 4, 2026, regarding the data they claim to have obtained from the institution. The listing includes general information about the municipality and provides ten links that allegedly lead to the stolen data. It is important to note that the group's claims regarding the breach have not been independently verified.

Details regarding the alleged data breach

While the ransomware group has published a listing for the municipality, the specific types of data allegedly leaked are not mentioned in the announcement text. Because the group has not provided details on the exact nature of the files, the specific contents remain unknown. However, given the nature of municipal data, it may contain administrative and personal records.

The listing names no specific data types in a list.

About the organization

Nandrin is a municipality located in the province of Liège, in the Wallonia region of Belgium. As a public institution, it is responsible for providing various local government services to its residents.

Analysis and implications for the public sector

This situation may pose a risk of exposure for sensitive citizen data held by local government units. As the institution is based in Belgium, a potential data breach could lead to legal sanctions under the EU General Data Protection Regulation (GDPR). The implications of such a breach for a public entity are significant, as local governments often manage a high volume of sensitive personal information.

Given the past activities of the LockBit group, it is possible that the leaked data could be used for identity theft or targeted phishing attacks. The fact that the institution provides public services suggests that the breach could also have indirect effects on supply chain security. Ransomware groups often utilize a double extortion tactic, where they not only encrypt an organization's systems but also threaten to leak sensitive data to pressure the victim into paying a ransom.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported to have returned with a new version after its infrastructure was disrupted in February 2024. This resilience highlights the ongoing threat posed by sophisticated RaaS models. To defend against such threats, organizations in the government and defense sector typically focus on robust security measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to mitigate the risk of phishing.