smed.at Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

S.Med Handels GmbH, operating as smed.at, is an Austrian pharmaceutical company based in Vienna and owned by a family. On December 25, 2025, the LockBit5 ransomware group listed the company on its leak site, claiming that internal files had been exfiltrated during a ransomware attack. No confirmed count of affected individuals has been released, and the company has not issued a public statement detailing the scope or verification of the listing.

What happened

The incident came to light through a listing on the LockBit5 ransomware group's leak site on December 25, 2025. The group claims that internal files were taken from smed.at during a ransomware operation. No information has been made public about the date of the intrusion itself, the volume of data involved, or whether encryption of systems occurred alongside the exfiltration. The number of people potentially affected remains unknown.

Inside lockbit5

LockBit is a ransomware operation that has conducted numerous attacks since at least 2019, employing a ransomware-as-a-service model in which affiliates carry out intrusions and share proceeds with the group's operators. Its typical approach involves gaining access to corporate networks, deploying encryption tools, and threatening to publish stolen data if a ransom is not paid. The group maintains a leak site where it lists victims and, in some cases, posts samples of claimed data. Any specific assertion about smed.at originates solely from the group's own listing and has not been independently confirmed in available reporting.

smed.at and its sector

S.Med Handels GmbH is a family-owned pharmaceutical company headquartered in Vienna. Organisations in this sector routinely manage supply-chain records, regulatory submissions, product formulations, and commercial agreements. A disruption or disclosure of such material can affect operational continuity and regulatory compliance obligations under Austrian and EU rules governing medicinal products.

What data was at risk

The only detail released is that internal files were claimed to have been exfiltrated. The precise categories of information contained in those files have not been disclosed. Pharmaceutical companies commonly store records that include business correspondence, inventory data, and limited personal information related to employees or partners; however, the actual contents of the exfiltrated material remain unconfirmed.

The real-world impact

Exposure of internal pharmaceutical files can create competitive or regulatory concerns for the company and may lead to follow-on scrutiny from Austrian data-protection authorities. For any individuals whose information appears in the files, the primary risks are potential misuse of contact details or professional records. No evidence of subsequent public distribution of the material has been reported at this stage.

If your data was in this claimed breach

Monitor official communications from S.Med Handels GmbH and any notifications required under GDPR. Review account statements and correspondence for unusual activity. Individuals can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.