Skycc.co.th listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Thailand
• Announcement date: October 14, 2026

The Lockbit5 ransomware group has officially listed the Thailand-based organization skycc.co.th on its dedicated leak site. According to the announcement, the threat actors claim to have compromised data belonging to the company, threatening to publish the stolen information if their demands are not met.

Details of the claimed attack

The announcement regarding the breach was published on October 14, 2026. In the claim, the Lockbit5 group asserts that they successfully targeted skycc.co.th and have obtained sensitive information. While the announcement was made on October 14, the threat actors have identified the date of the actual incident as October 13, 2026.

This type of activity is characteristic of modern ransomware operations, which often employ a double extortion tactic. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to release this data on a public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of their proprietary or customer information.

Information regarding the leaked data

Despite the claims made by the Lockbit5 group, the current listing remains vague regarding the specific nature of the stolen assets. At this stage, no screenshots or detailed information regarding the content of the allegedly leaked data have been provided by the attackers. Furthermore, the group has not disclosed any specifics regarding the volume of the data or the total number of files involved in the breach.

• No specific data types were identified in the listing.

The absence of specific details is common in the early stages of a leak site posting, as attackers often use the initial listing as a way to signal the success of the breach before providing further evidence or negotiating terms.

About skycc.co.th

SKY CC Company Limited is a Thailand-based company specializing in customer experience (CX) management and contact center services. The company provides comprehensive communication solutions and customer support processes for businesses, playing a role in managing the interactions between businesses and their clients.

Potential impact and organizational risks

This incident may lead to disruptions in the organization's operational processes and the exposure of sensitive customer data. If a data breach has indeed occurred, secondary risks such as identity theft and targeted phishing attacks may arise for the affected parties. Because the organization manages customer experience and communication solutions, the exposure of data could potentially impact the trust and security of the business relationships they maintain.

The group responsible, Lockbit, is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is notable that the group has returned with a new version after their infrastructure was disrupted in February 2024. This resilience highlights the ongoing challenge posed by sophisticated RaaS models that can adapt and re-emerge following law enforcement interventions.

Furthermore, the organization may face legal obligations under data protection regulations in Thailand following this event. Organizations operating in the customer service and communication sector typically must adhere to strict regulatory frameworks to ensure the privacy and security of the data they process on behalf of their clients. When a breach is suspected, organizations often focus on incident response, which includes forensic investigation, containment of the threat, and assessing the scope of the data exposure to meet regulatory notification requirements.