Lockbit5 ransomware group lists towellholding.com on its leak site

• Ransomware group: Lockbit5
• Country: Oman
• Sector: Manufacturing
• Announcement date: December 26, 2025

The LockBit5 ransomware group has listed towellholding.com on its dedicated leak site, threatening to publish the organization's data. This development follows a pattern of double extortion often employed by modern ransomware operations, where threat actors not only encrypt an organization's systems but also steal sensitive information to use as leverage for ransom demands.

The claimed attack and deadline

According to the announcement made on the group's leak site on December 26, 2025, the LockBit5 group claims to have successfully compromised the data belonging to towellholding.com. The threat actors have set a deadline of January 14, 2026, for the publication of the files if their demands are not met.

LockBit5 is a ransomware operation that has been active since 2019. The group is known for its evolving tactics and has been reported to have updated its infrastructure as recently as February 2024. Ransomware leak sites serve as a public stage for these groups to exert pressure on victims, often creating significant psychological and reputational stress for the targeted entities.

Data involvement and details

Regarding the specifics of the alleged breach, the listing provides no details or sample files regarding the nature of the allegedly compromised data. No information has been provided concerning the volume of data stolen or the specific file count involved in this incident. Furthermore, the group has not disclosed any specific ransom demand associated with this particular listing.

Affected data types

• The listing names no specific data types.

Organization profile

Towell International Holding is a holding company that owns and operates various reputed businesses across Kuwait and the MENA region. It maintains diverse commercial investments and operations across multiple sectors.

Potential impact and organizational risks

The potential leak of the organization's data may lead to operational disruptions and reputational damage. If the breach occurs, the exposure of sensitive data belonging to employees or business partners could create risks for identity theft or targeted phishing attacks. Given its status as a regional holding company, the incident may have legal implications under relevant data protection regulations in the operating countries.

Considering the past methods of the LockBit group, the possibility of data publication or sale to third parties should be taken into account. In such scenarios, organizations often face a multi-layered crisis involving regulatory scrutiny, loss of stakeholder trust, and the ongoing threat of secondary attacks targeting the leaked information.

To mitigate these risks, organizations in the manufacturing and holding sectors typically focus on robust defensive measures. This includes implementing strict access controls, maintaining comprehensive logging to detect unauthorized lateral movement, and ensuring that all software and infrastructure components are patched against known vulnerabilities. Furthermore, regular data backups and a well-tested incident response plan are essential components of a modern cybersecurity posture to minimize the impact of such extortion attempts.