spg.co.kr listed on LockBit5 leak site following alleged data breach

• Ransomware group: LockBit5
• Country: South Korea
• Announcement date: September 29, 2026

LockBit5 claims data breach at spg.co.kr

The LockBit5 ransomware group has officially listed the South Korean organization spg.co.kr on its dedicated leak site. This announcement, made on September 29, 2026, includes an allegation that the threat actors have successfully breached the organization's network and compromised its data. The listing serves as a public claim by the group regarding their unauthorized access to the company's internal systems.

Ransomware leak sites are platforms utilized by cybercriminal groups to exert pressure on victims. These sites typically host lists of compromised organizations, often accompanied by claims of data theft. Such tactics are central to modern ransomware operations, where the threat of exposing sensitive information is used as leverage to demand payments from the targeted entities.

Details of the alleged incident

According to the announcement posted by the threat actors, the inclusion of spg.co.kr on their platform occurred on September 29, 2026. The group asserts that they have gained access to the organization's network, leading to the compromise of its data. This claim was communicated to the public through the group's official listing on their leak site.

Despite the public nature of the claim, specific details regarding the nature of the allegedly compromised data have not been provided by the group. The available information, such as screenshots associated with the listing, only displays the general landing page of the Ransomware.live platform and does not contain any specific data samples or evidence related to the organization's actual files. Consequently, the exact volume of data or the specific types of information involved remain unknown at this time.

About spg.co.kr

SPG Co., Ltd is a South Korea-based industrial equipment manufacturer. The company specializes in the production of robot reducers, planetary gearheads, and various motor solutions. Their product portfolio is designed to serve a wide range of applications within automation and precision motion control systems, providing essential components for industrial manufacturing processes.

Risk assessment and industry implications

LockBit5 is a ransomware group that has been active since 2019. The group reportedly underwent a reorganization following infrastructure disruptions that occurred in February 2024. The current allegation of a data breach against spg.co.kr poses potential risks, such as the exposure of trade secrets or the personal information of employees. Because the organization is based in South Korea, any confirmed data breach could lead to legal proceedings under local data protection regulations.

Until the specific nature of the alleged data is clarified, secondary risks may emerge, including the possibility of identity theft or targeted corporate phishing attacks. Given the historical methods employed by LockBit5, it is expected that the group may continue to exert pressure on the organization by pursuing a double-extortion strategy. In double-extortion schemes, attackers not only encrypt data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

For organizations operating in the industrial and automation sectors, maintaining robust cybersecurity postures is critical. Defensive measures often include implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous network monitoring to detect unauthorized access. As threat actors continue to target industrial manufacturers, the potential for both operational disruption and the exposure of intellectual property remains a significant concern for the sector.