Planetsport.ma listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Morocco
• Sector: Retail & E-Commerce
• Announcement date: April 29, 2026

The Morocco-based retail company planetsport.ma has been listed on the leak site operated by the LockBit ransomware group. According to the announcement made by the threat actors, the organization has been targeted as part of the group's ongoing ransomware activities.

The claimed attack details

The LockBit group officially listed the entity planetsport.ma on its leak site on April 29, 2026. While the announcement appeared on the leak site in late April, the threat actor claims to have successfully gained access to the organization's systems much earlier, specifically on April 13, 2026. By listing the organization on their platform, the group indicates that they may proceed to release associated data as part of their extortion tactics.

Ransomware groups often utilize leak sites to exert pressure on their victims. In many cases, these groups employ a strategy known as double extortion, where they not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information online if a ransom is not paid. This method aims to maximize the pressure on the victim by threatening their reputation and legal standing.

Data involvement and information availability

Regarding the specifics of the incident, there is no information available regarding the nature of the leaked or threatened data. The provided screenshot associated with the listing displays only the general landing page of the leak site, providing no further details on the contents of the breach. Consequently, the listing names no specific data types that have been compromised.

Potential risks of data exposure

When an organization is targeted by ransomware groups like LockBit, the potential consequences for stakeholders can be significant. This situation may carry the risk of exposing personal data belonging to the organization's customers. For an entity operating in the e-commerce sector, such a leak could lead to a loss of customer trust and significant reputational damage.

Depending on the actual content of the data, secondary risks may emerge following a breach. These secondary risks can include identity theft or the execution of targeted phishing attacks against the affected individuals. Organizations typically attempt to mitigate these risks through robust security frameworks, regular auditing, and incident response planning.

Organization profile

Planet Sport is a sports equipment retailer based in Morocco. It operates as an e-commerce platform that specializes in the sale of various items, including sports gear, apparel, and footwear.

Threat actor profile and industry implications

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. It is important to note that the group's methods may vary; it has been reported that the group returned with a new version after their infrastructure was disrupted in February 2024. This evolution in their operational capabilities suggests that organizations must remain vigilant against changing tactics.

For companies in the retail and e-commerce sectors, maintaining high standards of data protection is critical. Common defensive steps for organizations facing such threats include implementing multi-factor authentication, maintaining offline backups, and conducting regular vulnerability assessments to identify weaknesses before they can be exploited by threat actors.