formula50.it Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
formula50.it was listed by the LockBit5 ransomware group on March 30, 2026, after internal files were exfiltrated in a ransomware attack that affected an undisclosed number of people. Anyone who had dealings with the site should verify whether their information was exposed and change passwords or monitor accounts as needed.
What happened
The only confirmed information is the March 30, 2026 listing itself. The group claims internal files were taken. No independent confirmation of the exfiltration, the volume of data, or any ransom demand has been reported. The number of individuals whose information may be involved is stated as unknown.
Who is lockbit5?
Lockbit5 is a ransomware operation that has conducted multiple campaigns since at least 2019. Public reporting describes its use of double-extortion tactics, in which data are both encrypted on victim systems and copied for potential release. The group maintains a leak site where it lists organisations it claims to have targeted. Listings on the site represent the group's assertions rather than independently verified events.
Who is formula50.it?
Formula50.it operates in the pharmaceutical information technology sector and conducts business at a national level. Public descriptions of the organisation emphasise its focus on IT services for pharmaceutical processes. Entities in this sector routinely manage systems that support drug development, regulatory compliance, and supply-chain operations.
What was likely exposed
The listing refers only to “internal files exfiltrated in ransomware attack.” No specific categories of data, file counts, or time ranges have been disclosed. Organisations of this type commonly hold records related to research, regulatory submissions, partner communications, and operational systems, yet the exact contents of any exfiltrated material remain unconfirmed.
Why it matters
Pharmaceutical IT environments can contain information whose exposure carries regulatory, commercial, and operational implications. Individuals connected to the organisation—whether as employees, partners, or patients—may face risks if personal or professional details appear in the claimed files. The organisation itself must address potential disruption to its systems and any resulting compliance obligations.
Were you affected?
Individuals who have interacted with formula50.it can begin by monitoring official statements from the organisation. Checking whether an email address appears in known breach data through a free exposure scan provides one practical step. Any further personal action depends on information the company may release about the incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
wibeats.it Listed by lockbit5 Ransomware Groupsirsa.it Listed by lockbit5 Ransomware Groupsparkinter.com Listed by lockbit5 Ransomware Groupanser-coding.com Listed by lockbit5 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the formula50.it Listed by lockbit5 Ransomware Group →
Publicly posted by lockbit5 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.