Lockbit5 ransomware group lists pegasussrl.com on its leak site

• Ransomware group: Lockbit5
• Country: Italy
• Sector: Professional Services
• Announcement date: April 14, 2026

LockBit claims data breach at Pegasus Srl

The LockBit ransomware group has officially listed pegasussrl.com on its dedicated leak site, claiming that the organization has been the victim of a data breach. This announcement, made on April 14, 2026, follows a period of alleged unauthorized access to the company's systems. The group has initiated a countdown process as part of its extortion tactics, a common feature of modern ransomware operations.

According to the claims made by the threat actor, the initial compromise of the organization's data is alleged to have occurred on March 18, 2026. This timeline suggests that the attackers may have had access to the environment for several weeks before the public announcement was made on their leak portal. Ransomware groups often use these countdown timers to exert psychological pressure on victims, aiming to force a ransom payment before the stolen information is released to the public.

Details regarding the alleged stolen data

Despite the public listing on the LockBit leak site, there is currently no specific information regarding the nature of the alleged leaked data. The record and the associated screenshots provided by the group do not contain details regarding the specific types of files or the volume of information that has been compromised. The listing names no data types.

In many ransomware scenarios, groups employ a tactic known as double extortion. In this model, attackers do not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. If a victim refuses to pay the ransom to decrypt their systems, the attackers threaten to publish the stolen data on a public leak site, causing significant reputational and regulatory damage.

About Pegasus Srl

Pegasus Srl is an insurance agency based in Prato, Italy. The company operates as an agency for Unipol Assicurazioni and provides a variety of insurance products and brokerage services to its clients. Given its role in the professional services sector, the organization handles sensitive information related to its insurance business operations.

Potential implications and industry risks

The situation presents significant risks for the organization involved. Because Pegasus Srl operates as an insurance agency, there is a possibility that the leaked data could contain personal and financial information belonging to its customers. Such a breach could lead to serious consequences, including identity theft and targeted phishing attacks directed at the affected individuals.

From a regulatory perspective, the potential exposure of customer data could lead to legal and administrative sanctions for the organization under the GDPR regulations that are applicable in Italy. The operational history of the LockBit group, which has been monitored since 2019, highlights the persistent threat they pose. It is noted that the group returned with a new version after their infrastructure was disrupted in February 2024. The group's history suggests that the organization may face significant reputational damage if the claimed data is eventually published.

For organizations operating within the professional services and insurance sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees. Furthermore, organizations must be prepared to follow strict regulatory reporting requirements if a breach is confirmed, to mitigate legal exposure and protect their client base from secondary risks like fraud.