Lockbit5 ransomware group lists roamingnetworks.rs on its leak site

• Ransomware group: Lockbit5
• Country: Serbia
• Sector: Technology
• Announcement date: March 30, 2026

The LockBit ransomware group has listed Roaming Networks on their dedicated leak site, claiming to have successfully exfiltrated data from the organization. This announcement, posted by the threat actor, marks a significant development in the ongoing targeting of technology and telecommunications infrastructure providers.

The claimed attack and event details

According to the announcement published on the group's leak platform, the incident is alleged to have occurred on March 14, 2026. The LockBit group claims to have breached the networks of Roaming Networks and subsequently obtained various pieces of data. The group's post serves as a public notification of the alleged intrusion, a common tactic used by ransomware operators to exert pressure on victims.

In the announcement, the threat actors provided nine distinct links intended for the alleged stolen data. This method is often utilized by ransomware groups to demonstrate the scale of their breach and to provide proof of the data they claim to have acquired during their unauthorized access to the victim's environment.

Details regarding the leaked data

While the group has provided multiple download links, there is no specific detail provided in the announcement regarding the nature of the leaked data. The listing does not specify the types of files, the volume of information, or the specific categories of data that were allegedly compromised during the breach.

• No specific data types were named in the listing.

About Roaming Networks

Roaming Networks is a technology company based in Serbia. The firm specializes in providing design, installation, integration, and maintenance services for telecommunications networks and systems. Beyond its local operations, the organization maintains a significant presence in the international market, operating on various telecommunications infrastructure projects across Europe and the Middle East.

Impact assessment and industry implications

This incident may negatively impact the organization's operational continuity and commercial reputation. The potential consequences of such a breach are multifaceted, depending on the nature of the information compromised. If the leaked data includes customer information or technical infrastructure details, secondary risks such as targeted phishing attacks may emerge for the telecommunications sector the company serves.

Furthermore, as the organization is based in Serbia, compliance obligations regarding local data protection regulations may be triggered by this event. Organizations operating in highly regulated sectors must remain vigilant regarding the legal and regulatory ramifications that follow a data breach.

The group involved, LockBit, has been active since 2019 and is known to have updated its infrastructure in February 2024. LockBit is recognized for using double extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak sensitive information if a ransom is not paid. This approach increases the pressure on victims by targeting their reputation and regulatory standing. To defend against such threats, organizations typically focus on robust network segmentation, continuous monitoring, and comprehensive employee training to mitigate the risk of initial access and subsequent data exfiltration.