pkmsteel.com listed on LockBit5 leak site following alleged data breach

• Ransomware group: LockBit5
• Country: India
• Sector: Manufacturing
• Announcement date: March 30, 2026

The LockBit5 ransomware group has officially listed pkmsteel.com on its dedicated leak site, claiming that the organization has been the victim of a data breach. This announcement, posted on March 30, 2026, marks the latest development in the group's ongoing activities targeting various industrial entities.

The alleged attack and group claims

According to the announcement published on the LockBit5 leak portal, the group claims to have targeted pkmsteel.com. The group alleges that the cyberattack took place on February 24, 2026. In the listing, the threat actors provided ten different links, which they claim contain stolen data belonging to the organization.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. These groups often use these portals to host stolen information, intending to shame the victimized organization into paying a ransom. This tactic is a core component of modern cyber extortion, where the threat of publicizing sensitive data is used as leverage during negotiations.

Details of the alleged data breach

While the group has provided links to supposedly stolen files, the announcement is notably lacking in specific details regarding the contents of the breach. There is no specific information available in the announcement or records regarding the nature of the leaked data. Furthermore, the group has not disclosed the total size of the data or the specific number of files that were allegedly exfiltrated during the incident.

The listing names no specific data types that have been compromised.

The organization profile

PKM Steel Service, Inc. is an American company specializing in the production of heavy and intermediate structural steel. The company provides steel fabrication and supply services for industrial and commercial projects.

Impact and industry implications

This alleged breach may pose a significant risk of exposing the organization's trade secrets and operational data. For an entity operating within the manufacturing sector, such a leak could lead to the loss of intellectual property and a subsequent reduction in competitive advantage. The loss of proprietary manufacturing processes or client lists can undermine a company's position in the market.

The LockBit group typically aims to pressure its victims using double extortion methods. In a double extortion scenario, attackers not only encrypt the victim's systems but also steal sensitive data, threatening to release it publicly if the ransom is not met. Consequently, risks of identity theft or targeted phishing attacks against the organization's clients and employees may emerge as a secondary consequence of the breach.

Since the organization is based in India, legal risks regarding compliance with local data protection regulations may arise following such an incident. Organizations facing these types of threats often focus on defensive measures such as implementing robust backup solutions, enforcing multi-factor authentication, and maintaining strict network segmentation to prevent lateral movement by attackers.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. It is reported to have returned with a new version after its infrastructure was disrupted in February 2024, demonstrating the resilience and evolution of such sophisticated cybercriminal operations.