sosltda.com listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Colombia
• Sector: Professional Services
• Announcement date: February 14, 2026

Lockbit5 claims attack on sosltda.com

The Lockbit5 ransomware group has officially listed the Colombian entity sosltda.com on its dedicated leak portal. According to the claims made by the threat actor group, the institution was subjected to a cyberattack on August 29, 2025. The group has established a deadline of February 27, 2026, for the potential publication of the organization's data.

Ransomware leak sites function as a tool for double extortion, a tactic where attackers not only encrypt an organization's internal systems but also threaten to release sensitive information to the public to increase pressure for ransom payments. By listing a target on a public portal, these groups aim to maximize visibility and reputational damage to coerce the victim into meeting their demands.

Details regarding the alleged breach

While the listing confirms that the organization has been targeted, the group has not provided specific details regarding the content of the leaked or threatened data. No information has been disclosed concerning the volume of files or the specific nature of the information allegedly stolen during the incident.

The listing names no specific data types.

The target organization

The organization identified in the leak, sosltda.com, is a professional services provider based in Colombia. Specifically, the entity operates as a provider of security solutions within the region.

Analysis and potential implications

The involvement of a security solutions provider in a ransomware incident introduces significant complexities. Because the organization's core business involves providing security to others, a potential data breach may pose substantial supply chain risks. If the data involved in such a breach includes sensitive client information or documents related to security strategies, the institution could face significant reputational damage and legal sanctions.

The Lockbit5 group is recognized as a Ransomware-as-a-Service (RaaS) structure. This model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks, creating a highly scalable and continuously updating infrastructure. Such groups have been active in the cyber threat landscape since 2019.

Furthermore, the organization may face obligations under local Colombian legislation and data protection regulations. Such regulatory requirements often trigger secondary risks, including targeted phishing attacks aimed at the organization's clients or partners who may be concerned about the breach. Organizations in the security sector often prioritize defensive measures such as network segmentation, robust identity and access management, and continuous monitoring to mitigate these types of threats and protect their supply chain integrity.