Smed.at listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Austria
• Sector: Technology
• Announcement date: December 26, 2025

Lockbit5 claims smed.at in latest leak site announcement

The Lockbit5 ransomware group has announced the listing of the Austria-based entity smed.at on its leak site. This announcement, made on December 26, 2025, marks a new development in the group's ongoing activities. The group has claimed the attack occurred on December 7, 2025, though the specific details regarding the nature of the breach remain unverified.

Details of the claim and the group's ultimatum

According to the announcement posted on the group's leak portal, smed.at has been added to their target list. The listing provides general information about the company and establishes a specific deadline for the organization. The group has specified a deadline of January 9, 2026, for the entity to comply with their demands. The group claims that it may publish the company's data if the ransom demands are not met by the specified date.

Ransomware groups often utilize these leak sites as a method of double extortion. In such scenarios, attackers not only encrypt a target's internal systems to disrupt operations but also threaten to release sensitive information to the public or specific stakeholders to increase pressure on the victim. This tactic is designed to create maximum leverage during negotiations by threatening the organization's reputation and legal standing.

Data involved in the alleged breach

Regarding the contents of the alleged breach, no details regarding the nature of the leaked or threatened data have been provided by the group. The listing does not specify the types of files, the volume of information, or the specific databases that may have been targeted.

About smed.at

S.Med Handels GmbH is a family-owned Austrian pharmaceutical company based in Vienna. It operates in the trade and distribution of medical products.

Risk assessment and implications for the sector

This leak claim may pose risks to the entity's operational continuity and commercial reputation. Given that the entity is based in Austria, a potential data breach could lead to legal sanctions and administrative fines under the GDPR (EU General Data Protection Regulation). The entity's operation in the pharmaceutical sector may increase the sensitivity of the compromised data and could trigger secondary risks for third parties.

The Lockbit group is known as a structure that has been active since 2019 and has continued its operations by updating its infrastructure. Because of this longevity and evolving technical capabilities, it is advisable for the entity to review its data security processes and take necessary precautions. Organizations operating within the pharmaceutical and medical supply chain sectors often face heightened scrutiny due to the sensitive nature of the data they handle, which can include proprietary business information and potentially sensitive client or regulatory data.

To mitigate such risks, organizations typically focus on robust defensive measures. These include maintaining comprehensive backups, implementing strict access controls, and conducting regular security audits. Furthermore, staying vigilant regarding the evolving tactics of long-standing ransomware groups is a critical component of a modern cybersecurity posture. As these groups update their infrastructure to bypass defenses, continuous monitoring and rapid incident response capabilities become essential for maintaining operational continuity and compliance with regional regulations like the GDPR.