常州金蝶ERP-MES系统-WMS系统-PLM软件-江苏智蝶（原常州金蝶软件公司）数字科技有限公司
bd_8db049218b4652af · schema v1 · pii pii-v1
Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Lockbit5 on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Sanctions caution: Lockbit5 carries US sanctions exposure — OFAC has designated the group or its operators. Public reporting is permitted (informational-materials exemption, 50 U.S.C. § 1702(b)(3)) — but any payment or material support may violate sanctions. Consult counsel before engaging.
Source: Ransomware.live
Post text · scraped from the leak site
公司简介 江苏智蝶数字科技有限公司(原常州金蝶)成立于1999年。是金蝶集团连续20多年优秀合作伙伴和2022首批“金蝶全国性交付伙伴”、江苏省高新技术企业、江苏省智能制造领军服务机构、江苏省专精特...
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Feb 15, 2026
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
lockbit5
According to ransomware.live, LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.