towellholding.com Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 24, 2025, the ransomware group lockbit5 listed towellholding.com on its leak site, claiming to have conducted a ransomware operation against the Kuwait-based holding company. The listing states that internal files were exfiltrated, though the number of individuals affected, the volume of data, and any ransom demands remain undisclosed in public reporting.

Such listings have become a routine feature of the current threat landscape, where ransomware operators combine encryption with data theft to pressure victims. The appearance of a regional holding company on a prominent leak site underscores how these incidents now extend beyond large multinationals to organisations that underpin local economies across the Middle East and North Africa.

What happened

The only confirmed public information is the December 24, 2025 listing itself. The group claims that internal files were removed during a ransomware attack on towellholding.com. No official statement from the organisation, no independent confirmation of the data volume, and no details on the timing or method of intrusion have been released. The number of people whose information may be involved is not known.

Inside lockbit5

Lockbit5 is the current iteration of a ransomware operation that has been active since 2019. The group is known for a ransomware-as-a-service model in which affiliates carry out intrusions while the core operators supply the encryption tools and maintain the leak infrastructure. Its typical approach involves initial access through compromised credentials or unpatched systems, followed by lateral movement, data exfiltration, and deployment of encryption. The group has previously listed organisations across multiple sectors and geographies; each new listing on its site represents an unverified claim until corroborated by the victim or independent investigation.

About towellholding.com

Towell International Holding is described as the owner of established companies operating in Kuwait and the wider MENA region. Holding companies of this type commonly maintain central administrative functions that support subsidiaries in sectors such as trading, services, and infrastructure. Records held by such entities frequently include corporate governance documents, financial reporting, supplier and partner agreements, and employee administration files. A successful intrusion therefore carries implications for both the parent organisation and the companies it controls.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No further inventory of data categories has been published. Organisations structured like Towell International Holding typically store employee records, contractual documents, financial statements, and operational correspondence. Whether any of these specific categories were taken, and in what quantity, has not been confirmed.

The real-world impact

For individuals whose information appears in the exfiltrated files, the primary risks are targeted phishing, identity misuse, or follow-on fraud attempts that leverage corporate email addresses or personal details. For the organisation and its subsidiaries, exposure of internal files can complicate commercial relationships, regulatory compliance, and internal investigations. Because the scale of the data remains unknown, the full extent of these consequences cannot yet be assessed.

What to do if you're exposed

Individuals who work with or for companies under Towell International Holding should treat any unexpected requests for credentials or personal information with caution. Enabling multi-factor authentication on all accounts, monitoring bank and credit statements for unusual activity, and using unique passwords remain basic protective measures. Readers can run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.