Skip to content
Ransomware

Lockbit5 ransomware group lists pricon.com.ph on its leak site

The LockBit ransomware group has listed pricon.com.ph on its leak site, alleging a data breach.

By
Siberpol Intelligence Unit
Published
3 min read
3 min read
  • Ransomware group: Lockbit5
  • Country: Philippines
  • Sector: Professional Services
  • Announcement date: April 29, 2026

The LockBit5 ransomware group has listed Pricon Microelectronics, Inc. (PMI) on its dedicated leak site, alleging that the organization has suffered a data breach. This announcement, made by the threat actor group, marks a new instance of the group's ongoing campaign of targeting various organizations through double extortion tactics.

The alleged attack and group claims

According to the announcement posted on the LockBit5 leak platform on April 29, 2026, the group claims to have gained unauthorized access to the organization's network. The group specifies that this access was obtained on April 17, 2026. Following the initial intrusion, the group has indicated that it is continuing its ransomware activities by threatening to publish the organization's data if its demands are not met.

Ransomware leak sites function as a public pressure mechanism used by cybercriminals. In a typical double extortion scenario, attackers do more than just encrypt a victim's systems; they also exfiltrate sensitive information. By threatening to release this data on a public platform, the attackers aim to maximize leverage over the victim, hoping that the threat of reputational damage or regulatory scrutiny will compel the organization to pay a ransom.

Details regarding the alleged data breach

At this stage, the group has not provided specific details regarding the nature or volume of the allegedly leaked data. No information has been provided regarding the specific files, the total size of the data, or the specific file count involved in the incident. Furthermore, no ransom demand has been publicly disclosed by the group in relation to this specific listing.

The evidence provided by the threat actor consists of a screenshot showing the general landing page of the leak site. This screenshot does not contain any specific data samples or evidence of the actual contents of the alleged breach. Consequently, the listing names no data types at this time.

About Pricon Microelectronics, Inc.

Pricon Microelectronics, Inc. (PMI) is a Philippines-based electronics manufacturing services (EMS) and original equipment manufacturer (OEM) company. The company specializes in the assembly and production of electronic components for various industries, serving as a key player in the electronics supply chain within the region.

Risk assessment and industry implications

The claim made by the LockBit5 group may pose a significant risk to the operational continuity of Pricon Microelectronics. Depending on the actual content of the leaked data, if employee or customer information is exposed, the organization may face risks such as identity theft and targeted phishing attacks. Additionally, the organization may face legal obligations under data privacy regulations in the Philippines.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported that the group returned with a new version after its infrastructure was disrupted in February 2024, which may indicate that the group's methods are evolving to bypass modern security defenses. This evolution highlights the persistent threat posed by sophisticated RaaS operations.

For organizations in the professional services and manufacturing sectors, maintaining robust cybersecurity posture is essential. Common defensive steps include implementing multi-factor authentication (MFA), maintaining regular offline backups, and conducting regular network segmentation to prevent lateral movement by attackers. Continuous monitoring and rapid incident response capabilities are also vital to mitigate the impact of such breaches and ensure business resilience.

From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

Related stories