THREAT WATCH · September 24, 2026 · RANSOMWARE LISTING

Italian IT Firm Corisricambi Listed by LockBit5

On September 24, 2026, the domain corisricambi.it was recorded on a ransomware tracker operated by the LockBit5 group. The organization is based in Italy and operates in the IT sector with an estimated workforce of 51 to 100 employees. No data has been publicly disclosed at this time.

Key takeaways

• Corisricambi.it recorded on a LockBit5 tracker on September 24, 2026
• No data has been publicly disclosed yet
• Organization is an Italian IT firm with 51-100 employees
• Mid-sized IT firms remain a frequent ransomware target

What is known

• The listing was recorded on September 24, 2026.
• The responsible group is identified as LockBit5.
• The organization operates in Italy within the IT sector.
• Company size is estimated at 51 to 100 employees.
• No data has been published or disclosed yet.

What this means for the organization

A listing on a ransomware tracker indicates that the group claims to have obtained data from the target. It does not confirm that a breach occurred or that data was exfiltrated. However, it is a strong signal that the organization may have been targeted.

For a company of this size, the operational impact can be significant. IT firms often manage sensitive client data, internal systems, and service-level agreements that depend on continuous availability. A ransomware event could disrupt operations, damage client trust, and trigger contractual penalties.

What to watch next

• Whether LockBit5 publishes any data or sample files in the coming days.
• Whether the organization issues a public statement or breach notification.
• Whether Italian data protection authorities become involved under the GDPR framework.
• Whether the listing is removed, which sometimes indicates a negotiation or a false claim.

Broader context

LockBit5 is a ransomware operation that has been active in recent months. The group has targeted organizations across multiple sectors and geographies. Italy has seen a steady number of ransomware listings in recent years, with IT and manufacturing firms among the most frequently recorded sectors.

Organizations of similar size and sector should treat this listing as a prompt to review their own defenses. Ransomware groups often target mid-sized companies because they may have fewer dedicated security resources than larger enterprises while still holding valuable data.

Recommended actions

• Verify whether your own organization has any relationship with the listed entity, including vendor or client connections.
• Review third-party risk assessments for IT suppliers of similar size.
• Ensure incident response plans are current and tested.
• Monitor for any follow-up disclosures from LockBit5 or the organization itself.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.