THREAT WATCH · September 29, 2026 · RANSOMWARE LISTING

LOCKBIT5 Lists Korean Retail Firm spg.co.kr

A retail and e-commerce organization operating under the domain spg.co.kr has been recorded on a LOCKBIT5 ransomware tracker. The listing was dated September 29, 2026. The company is based in the Republic of Korea and employs over 1,000 people. As of the listing date, the organization has not made a public disclosure regarding the matter. This post summarizes what is known from the listing, places it in context, and outlines steps stakeholders should consider.

Key takeaways

• spg.co.kr, a Korean retail and e-commerce firm, was recorded on a LOCKBIT5 tracker on September 29, 2026.
• The company employs over 1,000 people, indicating a large-scale operation.
• No public disclosure has been made by the organization as of the listing date.

What was recorded

• The domain spg.co.kr appeared on a tracker maintained by the LOCKBIT5 ransomware group.
• The listing date is September 29, 2026.
• The organization operates in the retail and e-commerce sector.
• The company is located in the Republic of Korea.
• Employee count exceeds 1,000, placing it in the large-enterprise category.
• The listing identifies the organization by domain only.

Disclosure status

• As of the listing date, the organization has not issued a public statement or disclosure.
• A listing on an attacker-side tracker is a strong signal but does not confirm a breach.
• Organizations may be listed without a confirmed data exfiltration event.
• The absence of disclosure may indicate the organization is still investigating, has not yet become aware of the listing, or has chosen not to comment at this time.
• Stakeholders should treat the listing as a signal to increase vigilance rather than as a confirmed incident.

What this means for stakeholders

• A listing on a ransomware tracker means the attacker group claims to have data or access associated with the organization.
• The absence of a public disclosure does not confirm or deny the claim.
• Companies with over 1,000 employees typically handle large volumes of customer and operational data.
• Retail and e-commerce operations often involve customer records, transaction histories, and supplier information.
• Stakeholders should monitor for any follow-up disclosure from the organization.
• Partners and vendors should evaluate whether their own systems or data may be indirectly affected.
• The large employee count suggests the organization likely has complex internal systems and a broad attack surface.

Recommended actions

• Monitor official channels of the organization for any disclosure or statement.
• Review any existing vendor or partner agreements with the listed entity.
• Assess whether your own data may be affected if you have a business relationship with the organization.
• Track the listing for updates, including any changes to disclosure status or additional details.
• Communicate internally with relevant teams so they are aware of the listing and can take appropriate steps if new information emerges.
• Prepare incident response plans in case the organization confirms a breach and downstream effects become apparent.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.