soeuae.ae listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: United Arab Emirates
• Sector: Professional Services
• Announcement date: December 26, 2025

Lockbit5 claims data breach at soeuae.ae

The Lockbit5 ransomware group has officially listed the Society of Engineers-UAE (soeuae.ae) on its dedicated leak site. According to the announcement made on December 26, 2025, the threat actor group claims to have successfully exfiltrated data from the organization. This development follows a period where the group alleges the attack occurred, with the post being dated December 24, 2025.

Ransomware groups often utilize leak sites as a tool for double extortion. In this model, attackers do not only encrypt an organization's systems to demand a ransom for decryption but also threaten to publish sensitive information on public forums to pressure the victim into paying. By listing a target on a public site, the group aims to increase visibility and pressure the entity to meet their demands.

Details of the alleged incident

The claim made by Lockbit5 suggests that the organization has suffered a significant data breach. While the group has publicly identified soeuae.ae as a victim, they have not provided specific details regarding the nature of the allegedly leaked data. The announcement remains vague regarding the volume of information stolen or the specific files involved.

The listing names no specific data types or file lists.

The organization profile

The Society of Engineers-UAE (soeuae.ae) is a non-profit professional organization based in the United Arab Emirates. Established in 1979, the society is dedicated to regulating and developing the engineering profession. Its primary mission is to foster professional collaboration among engineers and elevate engineering standards within the region. As a professional network, it serves to support professionals throughout the sector.

Risk assessment and industry implications

The claim made by the Lockbit5 group poses a significant risk regarding the exposure of personal and professional information belonging to the engineers within the organization. Because the entity functions as a professional network, any potential breach of its systems could lead to the misuse of member contact details and identity information. Such data is highly valuable to threat actors for conducting targeted phishing campaigns or other forms of social engineering.

Furthermore, the organization may face legal implications under the data protection regulations established in the United Arab Emirates. When professional organizations handle sensitive member data, they are subject to regulatory frameworks designed to protect individual privacy and ensure data integrity. A breach of this nature often triggers mandatory reporting requirements and potential legal scrutiny.

Lockbit5 is recognized as a Ransomware-as-a-Service (RaaS) group that has been active since 2019. The group has demonstrated persistence, reportedly returning with a new version of their malware following infrastructure disruptions in February 2024. This evolution suggests a high level of technical capability and a commitment to maintaining their operations despite law enforcement interventions. Additionally, there is a secondary risk that any leaked data could be leveraged by other threat actors to conduct further attacks.

For organizations operating within the professional services sector, maintaining robust defensive postures is critical. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security awareness training to defend against phishing. As threat actors continue to target professional bodies to access the identities of their members, continuous monitoring and proactive incident response planning remain essential components of a modern cybersecurity strategy.