marti.do Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What happened

The incident came to public notice through the lockbit5 listing on April 14, 2026. The group claims to have exfiltrated internal files from marti.do as part of a ransomware operation. No further details on the timing of the intrusion, the method of access, or the volume of data have been made public. The organisation has not issued a statement confirming or disputing the listing.

Who is lockbit5?

Lockbit5 is the current iteration of the LockBit ransomware operation, a group that has conducted numerous campaigns since 2019. The group typically uses ransomware-as-a-service arrangements, supplying encryption tools to affiliates who carry out intrusions. Its standard approach involves encrypting systems and then threatening to publish stolen data if a ransom is not paid. The listing of marti.do follows this pattern, though the group’s claims about any specific victim remain unverified until confirmed by the organisation or independent investigation.

marti.do and its sector

Marti.do describes itself as a business group with more than sixty years of experience. Organisations of this type commonly manage commercial operations, client records, supplier agreements, and internal administrative systems. A breach at such an entity can expose information that extends beyond the company itself to partners and customers whose details appear in ordinary business records.

What data was at risk

The only detail released is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been disclosed. Organisations in this sector routinely hold employee records, financial documents, contracts, and correspondence; however, it is not confirmed whether any of these specific types were among the material taken.

What's at stake

Exposure of internal business files can lead to secondary issues such as misuse of commercial information or attempts to impersonate the organisation in further contacts with clients or suppliers. Individuals named in the records may face increased risk of targeted phishing or identity-related fraud. The organisation itself may encounter operational disruption and costs associated with investigation and remediation, though the scale of these effects is not yet known.

What to do if you're exposed

Anyone who has done business with marti.do or who suspects their information may be present in the exfiltrated files should monitor accounts for unusual activity and consider placing fraud alerts with credit agencies. Changing passwords for any linked services and enabling multi-factor authentication are immediate steps that reduce further risk. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.