us-duct.com Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 21, 2026, the ransomware group lockbit5 listed us-duct.com on its leak site and stated that internal files had been taken from the company. The number of individuals affected remains unknown, and no further details on the volume or contents of the material have been made public. Incidents of this type continue to occur as ransomware operators maintain pressure on private-sector targets that hold operational and commercial records.

What happened

The listing appeared on the date noted above. The group claims to have carried out a ransomware operation that resulted in the exfiltration of internal files. No confirmation of the claim from the company or from independent sources has been reported, and the scale of the operation, the method of initial access, and any ransom demand remain undisclosed.

Inside lockbit5

Lockbit5 is the current iteration of a ransomware-as-a-service operation that has been active for several years. The group typically supplies encryption tools and a leak site to affiliates who locate targets and conduct intrusions. Its documented pattern involves encrypting systems and threatening to publish stolen data if payment is not received. Earlier versions of the operation have been linked to incidents across multiple industries, though each listing on the group’s site must be treated as an unverified claim until corroborated.

Who is us-duct.com?

US Duct Inc. is a privately held American company whose business is the design and manufacture of industrial duct systems. Organisations in this sector routinely maintain records related to product specifications, client contracts, supplier arrangements, and employee information. A compromise at such a firm can expose both commercial data and personal details of staff or customers even when the primary activity is physical manufacturing.

The information in question

The only detail released is that internal files were allegedly exfiltrated. The precise categories of data contained in those files have not been disclosed. Companies of this type commonly store engineering drawings, order histories, financial records, and contact information, but it is not possible to confirm whether any of those categories were present in the material taken.

What's at stake

Exposed internal files can be used for competitive intelligence, further social-engineering attempts, or resale on criminal forums. Individuals whose records appear in such material may face risks of targeted phishing or identity misuse. The organisation itself may encounter operational disruption and costs associated with investigation and recovery, though the extent of any such impact has not been stated publicly.

What to do if you're exposed

Anyone who believes their information may have been involved should begin by monitoring financial and email accounts for unusual activity. Passwords for any services linked to the organisation should be changed, and multi-factor authentication should be enabled where available. A short list of immediate steps includes:

• Review recent account statements and credit reports for anomalies.
• Change passwords on work-related and personal accounts that may share credentials.
• Enable or verify multi-factor authentication on email and financial services.
• Run a free exposure scan of your email address against known breach data to determine whether your information appears in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.