Wilhelmsen.com listed on LockBit5 leak site

• Ransomware group: LockBit5
• Country: Norway
• Sector: Transportation
• Announcement date: February 23, 2026

LockBit5 claims to have targeted wilhelmsen.com

The LockBit5 ransomware group has officially listed the Norway-based maritime company wilhelmsen.com on its dedicated leak site. According to the announcement made by the threat actors, the organization was targeted in a cyberattack that allegedly occurred on February 18, 2026. The group published this claim on its platform on February 23, 2026, marking the beginning of a potential data exposure incident.

The group alleges that it has successfully compromised the organization's data. Following this claim, the threat actors have issued threats to publish the stolen information on their leak site if their demands are not met. While the group's presence on the leak site is a significant indicator of a potential breach, the specific details regarding the breach remain limited to the group's unilateral claims.

Details regarding the alleged data breach

At this stage of the incident, the threat actors have not provided specific details regarding the nature or the content of the allegedly compromised data. There is no information available concerning the volume of files or the total size of the data involved. Furthermore, the group has not disclosed a specific ransom demand or any other terms related to the alleged extortion.

The only visual evidence provided by the group is a screenshot of a queue page, which is a standard mechanism used to manage traffic when users attempt to access the group's leak site. The listing names no specific data types.

The organization and the threat actor

The target of this alleged attack is wilhelmsen.com, a prominent entity operating within the transportation sector and based in Norway. The maritime company's involvement in global logistics and transportation makes it a high-profile target within its industry.

The group responsible, LockBit5, is a known Ransomware-as-a-Service (RaaS) entity that has been active since 2019. It is noteworthy that the group has reportedly returned with a new version of its operations following the disruption of its infrastructure in February 2024. This evolution highlights the persistent nature of RaaS models, where developers provide the malicious infrastructure to affiliates to carry out attacks.

Risks and industry implications

The claims made by LockBit5 pose significant risks to the organization, particularly regarding its operational continuity and its commercial reputation. For a company operating in the transportation and maritime sector, any disruption to digital operations or the exposure of sensitive business information can have far-reaching consequences for its global supply chain interactions.

Because the organization is based in Norway, any confirmed data breach may trigger complex legal processes under the General Data Protection Regulation (GDPR) and other relevant local data protection regulations. Such regulatory scrutiny often follows when personal or sensitive corporate data is compromised.

Beyond the immediate legal and operational concerns, the publication of the organization's data could create secondary risks. These include the potential for identity theft or the execution of highly targeted phishing attacks aimed at the organization's employees and business partners. In the broader context of ransomware, such attacks often utilize a double extortion tactic, where data is not only encrypted to halt operations but also stolen to leverage pressure through the threat of public disclosure.

Organizations in the transportation and maritime sectors often focus on strengthening defensive postures through robust backup strategies, network segmentation, and continuous monitoring to mitigate the impact of such sophisticated ransomware groups.