Saint-Pierre-des-Corps Ransomware Claim by LockBit5 (Oct 2026)

Claim Summary

On or around October 14, 2026, a threat actor operating under the name “lockbit5” allegedly posted saintpierredescorps.fr to its dark web leak site. The listing purportedly identifies the victim as a French public administration (“Une administration publique française”) and claims to hold professional and legal information belonging to the organization.

The claim does not disclose a data volume, sample files, or a ransom deadline in the material reviewed. The attack date is listed as October 14, 2026. None of these details have been independently confirmed, and the organization has not issued a public statement that Yazoul Security is aware of at the time of writing.

Threat Actor Profile

The actor behind this listing identifies as lockbit5. This branding is significant: it references the LockBit name, one of the most prolific ransomware operations historically, but the “5” suffix does not correspond to any confirmed, officially recognized LockBit version. Legitimate LockBit infrastructure was disrupted by international law enforcement action in 2024, and subsequent activity has been fragmented, with multiple copycats and splinter actors adopting the brand.

Yazoul Security has no public research references, tooling information, or confirmed victim counts attributed to this specific “lockbit5” persona. Its known tools and tactics are currently unknown. This absence of a verifiable track record is a meaningful credibility gap. Actors who adopt an established brand without demonstrable history may be:

• Genuine remnants or affiliates of the original operation,
• Opportunistic actors rebranding to borrow notoriety,
• Or actors posting exaggerated or recycled claims to pressure victims.

Given the lack of corroborating evidence, the group’s credibility should be treated as unestablished. No YARA rules or detection signatures specific to this actor are available at this time.

Alleged Data Exposure

According to the threat actor, the claimed data consists of “professional and legal information” tied to a French public administration. No data volume is disclosed, and no samples have been publicly verified by Yazoul Security.

Public administrations in France can hold records that include internal correspondence, contractual documents, and citizen-facing administrative data. However, the actor has provided no proof beyond a short textual description. Claims of this nature are frequently overstated to increase pressure on the victim. We cannot confirm the existence, scope, or sensitivity of any data allegedly taken, and no leaked material should be sought or accessed.

Potential Impact

If the claim is accurate, potential consequences for a French public administration could include operational disruption, regulatory scrutiny under GDPR and French data protection law, and reputational harm. Public sector entities may also face heightened attention from national cybersecurity authorities.

That said, this remains an allegation. There is no confirmation of encryption, service outage, or exfiltration. Impact assessment at this stage is speculative and should not be treated as established fact.

What to Watch For

• An official statement from saintpierredescorps.fr or French authorities confirming or denying an incident.
• Any notification from CNIL or ANSSI regarding a data protection matter.
• Publication of verifiable proof-of-data by the actor, which would raise confidence in the claim.
• Reuse of the “lockbit5” brand across additional victims, which could indicate an active campaign.
• Updates to our /intel/ actor tracking if new tooling or victim data emerges.

Disclaimer

This report is based solely on an unverified claim published on a ransomware group’s leak site. Yazoul Security has NOT independently verified the attack, the data exposure, or the actor’s identity. Ransomware groups routinely exaggerate or fabricate claims to pressure victims. Nothing here should be construed as confirmation of a breach. Organizations should rely on official statements and qualified incident response before drawing conclusions.