Lockbit5 ransomware group lists semplastik.com.tr on its leak site

• Ransomware group: Lockbit5
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: December 26, 2025

Lockbit5 claims to have targeted Sem Plastik

The Lockbit5 ransomware group has listed the Turkish manufacturing company Sem Plastik on its dedicated leak site. According to the announcement published by the group on December 26, 2025, the threat actor claims to have successfully compromised the organization's systems.

The group asserts that the initial compromise occurred on December 7, 2025. Following the alleged intrusion, the attackers claim to have obtained various data belonging to the institution. The ransomware group has issued threats to release the stolen information publicly if their demands are not met, a tactic often associated with modern cyber extortion campaigns.

Details regarding the alleged data breach

While the group has claimed responsibility for the attack and the theft of information, specific details regarding the scope of the breach remain unavailable. There is no information regarding the nature of the allegedly leaked data in the provided screenshot or registration records. Furthermore, no specific details were provided concerning the total size of the data or the total file count involved in the incident.

The listing names no specific data types that have been compromised.

About Sem Plastik

Sem Plastik is a Turkish company specializing in the production of plastic cups, containers, and packaging solutions, primarily for the food and beverage industry. They focus on disposable plastic products and maintain a significant manufacturing capacity.

Risk assessment and industry implications

This incident may pose risks to the institution's operational continuity and commercial reputation. Depending on the content of the leaked data, personal information belonging to employees or customers may require protection under regulations such as KVKK. Secondary risks include the potential use of leaked information for identity theft or targeted phishing attacks.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. It is reported to have returned with a new version after its infrastructure was disrupted in February 2024. This resurgence highlights the persistent threat posed by organized ransomware groups that utilize double extortion tactics. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to pressure the victim into paying a ransom through the threat of public disclosure.

In the event of a data breach, organizations may need to fulfill their legal obligations and notify the relevant authorities. For companies in the manufacturing sector, maintaining robust cybersecurity posture is essential to protect intellectual property and sensitive commercial data. Organizations often implement defensive measures such as multi-factor authentication, regular security awareness training, and comprehensive backup strategies to mitigate these types of threats.