THREAT WATCH · October 16, 2026 · RANSOMWARE LISTING

OCK.com.my appears on LOCKBIT5 list

OCK.com.my, a Malaysia-based IT organization with 51-100 employees, appears on a ransomware tracker associated with the LOCKBIT5 group. The listing was recorded on October 16, 2026. Its disclosure status is not disclosed yet. A listing is a signal, not proof of a confirmed breach. Executives should treat it as an early warning and verify internal systems, backups, and access logs before drawing conclusions.

Key takeaways

• OCK.com.my was recorded on the LOCKBIT5 tracker on October 16, 2026.
• The organization is Malaysia-based, in the IT sector, with 51-100 staff.
• Its disclosure status is not disclosed yet.
• A listing is a signal, not a confirmed breach.

Recorded details

• Organization: ock.com.my
• Domain: ock.com.my
• Ransom group: LOCKBIT5
• Listing date: October 16, 2026
• Country: Malaysia
• Sector: IT
• Company size: 51-100
• Disclosure status: Not disclosed yet

What this means

A listing means the organization appears on an attacker-side ransomware tracker. It is strong signal, not a confirmed breach. It may indicate data exposure risk, but it does not by itself confirm encryption, data theft, or business impact. The record should prompt verification rather than assumption. Teams should avoid public statements that go beyond the recorded facts.

Practical next steps

• Confirm whether any systems, accounts, or data show unusual activity.
• Validate backup integrity and recovery readiness.
• Review privileged access and remote access controls.
• Prepare internal and external communication plans in case facts change.
• Track updates to the listing and disclosure status.
• Document findings so leadership has a clear, current picture.

Bottom line

The record places ock.com.my on the LOCKBIT5 tracker as of October 16, 2026. Until more facts are available, treat it as an unconfirmed but serious signal and respond with verification, containment readiness, and clear communication.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 18, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.