Manuaco.pt listed on LockBit5 leak site

• Ransomware group: Lockbit5
• Country: Portugal
• Sector: Manufacturing
• Announcement date: December 26, 2025

The LockBit5 ransomware group has announced that it has targeted the Portuguese manufacturing company manuaco.pt. According to a listing on the group's leak platform, the threat actor claims to have successfully exfiltrated data from the organization. The announcement, which appeared on the group's leak site on December 26, 2025, indicates that the group has set a deadline of January 15, 2026, regarding the alleged ransom demands.

The alleged attack details

The LockBit5 ransomware group has published an announcement on its dedicated leak platform claiming responsibility for targeting manuaco.pt. According to the group's claims, the attack occurred around December 7, 2025. The listing serves as a public notification of the group's intent, a common tactic used by modern ransomware collectives to pressure victims into meeting their demands.

Ransomware leak sites function as a public gallery where cybercriminal groups post information about their victims. This practice is a core component of modern cyber extortion. By publicly naming a company, the attackers aim to maximize the psychological and reputational pressure on the victim organization. The group has specified a deadline for the resolution of their demands, which in this instance is set for January 15, 2026.

Data involved in the claim

While the group has claimed to have exfiltrated data from the company, the listing does not provide specific details regarding the nature of the allegedly exfiltrated data. No information was provided concerning the volume of files or the specific types of information that were taken during the incident.

Details regarding exfiltrated data

• No specific data types were named in the listing.

In many ransomware incidents, attackers utilize a method known as double extortion. This involves not only encrypting the victim's systems to disrupt operations but also stealing sensitive data to use as leverage. If a victim refuses to pay the ransom to decrypt their files, the attackers threaten to release the stolen data on these public leak sites to cause maximum reputational and legal damage.

About manuaco.pt

MANUAÇO is a company based in Portugal that has been operating since 2006. The organization functions within the manufacturing and metalworking sector. The company is known for providing metallic solutions and various production services designed to meet diverse industrial needs.

Potential risks and industry implications

This incident may pose significant risks to the company's operational continuity and its commercial reputation. Because the entity operates within Portugal, any confirmed data breach could lead to legal sanctions and investigations by data protection authorities under the General Data Protection Regulation (GDPR). Such regulatory scrutiny often follows the disclosure of a breach involving personal or sensitive corporate information.

Given the known double-extortion tactics employed by the LockBit group, it is possible that the exfiltrated data could be utilized in secondary attacks or targeted phishing campaigns. In these scenarios, stolen information is used to craft highly convincing fraudulent communications to deceive employees, partners, or customers. Furthermore, an indirect security risk may arise for the company's supply chain partners, as interconnected business relationships can sometimes serve as pathways for further exploitation.

For organizations operating in the manufacturing sector, maintaining robust cybersecurity postures is essential. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees. Monitoring for unauthorized data exfiltration and ensuring strict access controls are also fundamental defensive steps to mitigate the impact of such targeted campaigns.