moa.gov.eg Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 23, 2026, the ransomware group lockbit5 listed moa.gov.eg on its leak site and stated that internal files had been taken from the Egyptian Ministry of Agriculture and Land Reclamation. The number of individuals whose information may be involved is not known, and no further details on the volume or content of the material have been made public. The incident matters because the ministry holds records tied to land use, agricultural production, and regulatory decisions that can affect farmers, landowners, and supply-chain participants. Any confirmed exposure of such material would therefore extend beyond the agency itself to people and businesses that interact with it.

Inside the incident

The only confirmed information is the date of the leak-site listing and the group’s assertion that a ransomware operation resulted in the exfiltration of internal files. No figures for the number of records, the method of initial access, or subsequent events such as ransom demands or data publication have been released.

Who is lockbit5?

LockBit operates as a ransomware-as-a-service group whose affiliates deploy encryption malware and often copy data before demanding payment. The group maintains a public leak site on which it lists organizations it claims to have targeted. In this instance the group claims moa.gov.eg as a victim; independent confirmation of the claim has not been reported.

moa.gov.eg and its sector

moa.gov.eg belongs to Egypt’s Ministry of Agriculture and Land Reclamation, the government body responsible for agricultural policy, land allocation, and related regulatory functions. Ministries of this type routinely collect and store data on land titles, subsidy programs, crop statistics, and compliance inspections.

Because these records frequently contain details about individuals and commercial entities, an incident at such an agency can affect both administrative operations and the privacy of citizens who rely on the ministry’s services.

What was likely exposed

The reported facts state only that internal files were exfiltrated during a ransomware attack. The precise categories of information contained in those files remain undisclosed.

The real-world impact

Until the contents of the exfiltrated files are clarified, the concrete consequences for individuals cannot be determined. Potential effects could include the circulation of internal planning documents or, if personal identifiers are present, increased risk of targeted fraud or misuse of land-related records. The ministry has not published an official statement on remediation or notification procedures.

If your data was in this claimed breach

Individuals concerned about possible exposure should begin by reviewing any official communications issued by the ministry and by monitoring accounts linked to government services for unusual activity. Because the exact data types remain unconfirmed, broad precautions are advisable.

• Change passwords for any accounts associated with agricultural or land services and enable multi-factor authentication where available.
• Request copies of personal records held by the ministry to verify their accuracy.
• Run a free exposure scan of your email address against known breach data to check for prior appearances of your information.

AICompiled with AI assistance from public sources and published under our editorial standards.