Saico.co.th listed on Lockbit5 leak site following alleged data breach

• Ransomware group: Lockbit5
• Country: Thailand
• Sector: Professional Services
• Announcement date: June 20, 2026

Lockbit5 claims a data breach against saico.co.th

The Lockbit5 ransomware group has listed the domain saico.co.th on its dedicated leak site, alleging that a data breach has occurred within the organization. This announcement, made on June 20, 2026, follows a pattern of double extortion tactics often employed by modern ransomware operations, where threat actors not only encrypt systems but also threaten to release sensitive information to pressure victims into paying a ransom.

According to the claims made by the threat actors, they gained unauthorized access to the organization's systems as early as May 15, 2026. This indicates that the attackers may have maintained presence within the network for several weeks prior to the public announcement on the leak site. While the listing confirms the group's intent to publicize the incident, the announcement remains sparse regarding the specific mechanics of the intrusion or the immediate aftermath of the access.

Details regarding the alleged data theft

Despite the public listing on the leak site, the threat actors have not provided specific details regarding a ransom demand or the volume of the compromised data. There is no information available regarding the nature of the compromised or threatened data. The provided screenshot associated with the listing displays a general landing page of the leak site and does not contain any specific data samples related to the organization.

The listing names no specific data types that have been targeted or stolen during the alleged operation.

About saico.co.th

SAICO (Siam Agro Industry Pineapple and Others Public Company Limited) is a food processing company based in Thailand. The organization specializes in the production and export of canned pineapple and other fruit products, operating within the professional services sector.

Risk assessment and industry implications

This action by the Lockbit group may pose a risk to the organization's operational continuity. Although the nature of the compromised data remains unclear, given the organization's activities in the professional services sector, the potential exposure of client or employee information should be considered. Under Thailand's data protection legislation (PDPA), the organization may face legal obligations in the event of a confirmed data breach.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported to have resumed operations with a new version following infrastructure disruptions in February 2024. The persistence of such groups highlights the evolving nature of the threat landscape, where attackers frequently rebuild their capabilities to circumvent law enforcement actions.

Secondary risks resulting from such breaches may include identity theft and targeted phishing attacks against the organization's stakeholders. To mitigate these risks, organizations in the food processing and professional services sectors typically focus on robust defensive measures. These include maintaining strict network segmentation to prevent lateral movement, implementing multi-factor authentication across all remote access points, and maintaining comprehensive, offline backups to ensure operational continuity in the event of a successful encryption attack. Furthermore, continuous monitoring and rapid incident response capabilities are essential to detecting unauthorized access before data exfiltration can occur.