rdmetals.nl listed on LockBit ransomware leak site

• Ransomware group: Lockbit5
• Country: Netherlands
• Sector: Manufacturing
• Announcement date: December 26, 2025

LockBit claims attack on rdmetals.nl

The LockBit ransomware group has posted an announcement on its dedicated leak site claiming to have targeted rdmetals.nl. This latest listing follows a pattern of activity by the group, which uses these platforms to pressure victims by threatening the public release of stolen information. The announcement was published on the group's platform on December 25, 2025, though the group claims the attack itself took place on April 17, 2023.

Ransomware groups often employ a tactic known as double extortion, where they not only encrypt an organization's local systems to disrupt operations but also exfiltrate sensitive data. By threatening to leak this data on a public forum, the attackers aim to increase the pressure on the victim to pay a ransom. Such leak sites serve as a public gallery for the group's victims, often including general information about the target's business operations to validate their claims.

In this specific instance, the LockBit group's post provides a general overview of the company's business activities but does not provide specific technical details regarding the breach. The group has threatened to release the company's data publicly if their demands are not met, creating a situation of significant uncertainty for the targeted entity.

Details regarding the alleged data breach

Despite the threat of a public leak, the current information available on the LockBit leak site is limited. The group has not provided specific details regarding the nature or the volume of the data they claim to have compromised. There is no information available on the leak site regarding the specific nature of the compromised data.

The listing does not include any information regarding:

• The specific types of files or data categories involved
• The total size of the data exfiltrated
• The specific number of files stolen
• The amount of the ransom demanded by the attackers

When ransomware groups post these notices, they frequently omit specific data details in the initial phase to maintain leverage or to verify the victim's reaction. This lack of transparency makes it difficult for external observers to assess the immediate impact of the incident without further disclosures from the group or the victim.

About rdmetals.nl

RD Metals is a Netherlands-based certified partner specializing in metal waste processing and recycling. The company focuses particularly on the recovery of electronic waste and metal processing operations. As a player in the manufacturing and recycling sector, the company handles complex industrial processes involving various materials.

Potential risks and organizational implications

This alleged action by the LockBit group may pose risks to rdmetals.nl regarding data privacy and operational continuity. Because the company is based in the Netherlands, a potential data breach could lead to legal obligations and administrative sanctions under the General Data Protection Regulation (GDPR). The exposure of sensitive corporate or personal information can result in significant regulatory scrutiny and potential fines.

Furthermore, the publication of such data could damage the company's commercial reputation and potentially facilitate identity theft or targeted phishing attacks against third parties. When a company's data is leaked, it often provides malicious actors with the necessary information to conduct highly convincing social engineering campaigns against employees, partners, or clients.

LockBit is a group that has been active since 2019, operating under a Ransomware-as-a-Service (RaaS) model. This model allows various affiliates to use the group's infrastructure to conduct attacks, sharing the profits from ransoms. Despite previous infrastructure disruptions, the group appears to maintain its operations with new versions. To defend against such threats, organizations in the manufacturing and recycling sectors typically focus on robust backup strategies, multi-factor authentication, and continuous monitoring of their network environments to detect unauthorized data exfiltration early.