LockBit 5.0 has listed two more organisations as victims on its leak platform, according to threat intelligence reports published on 8 November: Brazilian agricultural company Grupo Telles and Sun Clinical Laboratories, a clinical laboratory business. Neither claim has been independently confirmed.

Grupo Telles, a Brazilian agricultural company whose website is grupotelles.com, was listed by LockBit 5.0 on its alleged data-leak platform, the claim being highlighted by the ThreatMon threat intelligence team on 8 November. At the time of reporting, no independently verified information was available about the alleged intrusion, the volume of any compromised information, the attack method, or whether the company suffered operational disruption.

The second listing names Sun Clinical Laboratories, in the healthcare and hospital sector. The country where the laboratory operates was not specified in the reporting. As with Grupo Telles, the listing alone does not establish that LockBit breached the organisation, encrypted its systems or stole patient information. Both cases remain unverified threat-actor claims, and further investigation is needed to establish whether either organisation suffered a confirmed security incident.

LockBit is one of the longest-running ransomware operations. After law enforcement disrupted the group in Operation Cronos in February 2024, it returned as LockBit 5.0, announcing the renewed version in September 2025. Threat researchers at SOCRadar observed 163 claimed victims in the first quarter of 2026, with Brazil accounting for 8.6 percent of the group’s claimed victims in that period and healthcare making up about 9.2 percent of its claims. The group operates a double-extortion model, stealing data before encrypting systems and threatening to publish it unless a ransom is paid.

Agricultural businesses and clinical laboratories both hold data that attackers can exploit. Farm companies run supply-chain and logistics systems whose disruption can halt deliveries, while laboratories hold patient records and test results that are sensitive under health privacy rules. A confirmed breach at either type of organisation would carry regulatory and reputational consequences well beyond the ransom itself.

For now, both listings should be read as allegations. Ransomware groups sometimes list companies they have not breached, exaggerate the data they hold, or recycle old material. Neither company has been reported as issuing a public statement so far, and no ransom amount or deadline has been disclosed for either listing. The test will be whether either organisation issues a statement, whether samples of stolen data appear, or whether independent monitors corroborate the claims. Until then, customers, partners and patients of both organisations should be alert to phishing attempts trading on the reports. Read the original reporting on Undercode News.