Lockbit5 ransomware group lists sportvision.ba on its leak site

• Ransomware group: Lockbit5
• Country: Bosnia & Herzegovina
• Sector: Technology
• Announcement date: April 14, 2026

The LockBit5 ransomware group has announced the listing of sportvision.ba on their dedicated leak site. This announcement, which was discovered on April 14, 2026, indicates that the group claims to have successfully targeted the organization in a cyberattack.

The alleged attack and claims

According to the information provided by the threat actor, the group has gained unauthorized access to the systems of sportvision.ba. While the listing was identified in mid-April of 2026, the group cites the actual date of the attack as November 25, 2025. This significant gap between the alleged intrusion and the public announcement is a common occurrence in ransomware operations, where actors may hold data for an extended period before moving to the extortion phase.

The group's claim of unauthorized access suggests a breach of the organization's digital perimeter. Ransomware groups often use such listings to signal to the victim that their data has been successfully exfiltrated, moving from the initial infection phase to the public pressure phase of their operation.

Details regarding the leaked data

At this stage, the specific nature of the allegedly leaked data remains unknown. The information provided does not include a specific list of documents, databases, or file types that have been compromised. The available evidence, such as the screenshot associated with the listing, displays only a generic entry page for the Ransomware.live platform and does not contain any specific files or a detailed inventory related to the breach.

The listing names no specific data types that have been compromised in this incident.

About sport vision

Sport Vision is a sports retailer based in Bosnia and Herzegovina. The company specializes in the sale of various products, including sports footwear, apparel, and equipment. Operating across several countries within the region, the company provides a wide range of products from various international sports brands to its customer base.

Analysis and industry implications

The LockBit group is a well-known Ransomware-as-a-Service (RaaS) entity that has been active since 2019. Following infrastructure disruptions in February 2024, the group reportedly returned to operations with new versions of their malware. This incident involving sportvision.ba may indicate that the group's operational continuity remains a threat and that customer data may be at risk of exposure.

The group appears to be utilizing a double-extortion strategy. In this model, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive data and threaten to publish it on public leak sites to pressure the organization into paying the ransom. This tactic significantly increases the pressure on an organization, as the threat shifts from operational downtime to the public exposure of sensitive information and potential regulatory consequences.

As the organization is based in Bosnia and Herzegovina, any potential data breach may require assessment under local data protection regulations to ensure compliance and determine notification requirements. For organizations in the retail and technology sectors, maintaining robust security postures is critical to defending against such sophisticated RaaS models. Common defensive strategies include implementing multi-factor authentication, maintaining offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized access attempts early in the attack lifecycle.