Marti.do listed on LockBit5.0 leak site following alleged data breach

• Ransomware group: LockBit5.0
• Country: Dominican Republic
• Sector: Manufacturing
• Announcement date: April 14, 2026

The LockBit5.0 ransomware group has listed marti.do on its leak site, claiming a data breach against the organization. This announcement, which surfaced on the group's platform, marks a new instance of the group targeting industrial and commercial entities.

The alleged ransomware attack

The LockBit5.0 group claims to have conducted a ransomware attack against marti.do. According to the announcement made on the group's leak site, the entity was listed on April 13, 2026. The group has reportedly set a deadline for the institution, specifying that they have until April 28, 2026, to comply. The group has threatened to publish the institution's data if their demands are not met by the stated deadline.

Ransomware attacks of this nature typically involve a multi-stage process where attackers gain unauthorized access to a network, escalate privileges, and eventually deploy encryption software. Once the data is encrypted, the attackers use the threat of leaking sensitive information to pressure the victim into paying a ransom. This method is a common tactic used by modern ransomware-as-a-service (RaaS) operations to maximize their leverage over the target.

Data involved in the claim

The content of the leaked or threatened data is not specified in the announcement or the provided records. The listing names no data types.

About marti.do

Marti is a Dominican Republic-based industrial and commercial group with over 60 years of experience. The company operates across various sectors and is known for its manufacturing and service operations in the region.

Analysis and potential implications

This alleged breach may lead to operational disruptions and potential reputational damage for the institution. If the compromised data includes employee or customer information, it could trigger legal processes under relevant data protection regulations in the Dominican Republic. The LockBit group typically employs double extortion tactics, pressuring victims by both encrypting data and threatening to leak it. This situation may also create secondary risks for the institution's supply chain partners and could facilitate targeted phishing attacks.

LockBit is a RaaS group monitored since 2019, which is reported to have returned with a new version following the disruption of its infrastructure in February 2024. The emergence of new versions of ransomware after law enforcement interventions highlights the persistent nature of these threat actors.

For organizations in the manufacturing and industrial sectors, such threats underscore the necessity of robust cybersecurity frameworks. Common defensive steps for organizations include maintaining offline, immutable backups to ensure data recovery without paying ransoms. Additionally, implementing strict access controls, such as multi-factor authentication (MFA), and conducting regular network segmentation can limit the lateral movement of an attacker within a corporate environment. Monitoring for unusual data exfiltration patterns and maintaining a comprehensive incident response plan are also critical components of a modern security posture.