Lockbit5 ransomware group lists proplastics.co.zw on its leak site

• Ransomware group: Lockbit5
• Country: Zimbabwe
• Sector: Manufacturing
• Announcement date: December 26, 2025

Lockbit5 claims data breach against proplastics.co.zw

The Lockbit5 ransomware group has listed the Zimbabwe-based manufacturing organization proplastics.co.zw on its dedicated leak site. This listing, which was discovered on December 26, 2025, involves an allegation of a data breach against the company. The threat actor group continues to engage in ransomware activities by threatening to publish the organization's data to exert pressure.

According to the claims made by the ransomware group, the institution was subjected to an attack process as early as September 9, 2025. This significant gap between the alleged initial attack and the public listing highlights a common tactic used by ransomware groups, where they may maintain presence within a network for an extended period before moving to the extortion phase.

Details regarding the alleged data breach

At this stage, the specific details regarding the nature of the leaked data have not been shared by the threat actors. The available evidence provided by the group consists of a screenshot that only displays a redirection screen to the LockBit 5.0 platform. Consequently, there is no information available regarding the specific types of files, the volume of data, or the total file count involved in this incident.

The listing names no data types.

The organization profile

Proplastics Limited is a leading manufacturer of plastic pipes and fittings based in Zimbabwe. The company provides various plastic piping solutions for the construction and infrastructure sectors.

Analysis and potential impact

The LockBit group operates as a Ransomware-as-a-Service (RaaS) structure. This model allows developers to lease their malware to affiliates who carry out the actual attacks. The group has been active since 2019 and reportedly returned with new versions following an infrastructure disruption in February 2024. The persistence of such groups poses a continuous threat to various industrial sectors.

This situation may indicate that the institution's operational continuity could be disrupted and sensitive corporate data could be exposed. The publication of such data may damage the institution's commercial reputation and create secondary risks for supply chain partners. Furthermore, given that the institution is based in Zimbabwe, obligations under local data protection laws may arise.

Based on the past methods employed by this group, it is assessed that targeted phishing attacks may increase following the data leak. Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt data to disrupt operations but also steal sensitive information to threaten its public release. This dual approach increases the pressure on the victim to pay the ransom.

To mitigate such risks, organizations in the manufacturing sector often implement defensive measures such as robust backup strategies, multi-factor authentication, and continuous monitoring of network traffic. Strengthening employee awareness regarding phishing attempts is also a critical component of a modern cybersecurity posture, especially when dealing with sophisticated RaaS groups.