The LockBit5 ransomware group has listed Thai furniture manufacturer Starmark on its leak site, in a claim first reported on 8 November 2026. The listing names Starmark, which trades at starmark.co.th and makes and imports premium furniture, as the group's latest alleged victim in the manufacturing sector.

The claim was picked up by the Ransomware.live tracker and reported by the ThreatMon threat intelligence team on 8 November. A separate threat-intelligence record published on 9 November confirms the leak-site post is dated 8 November 2026, and describes the company as a premium furniture manufacturer and importer based in Thailand.

What sets this claim apart is the trail of stolen credentials behind it. According to the Ransomware.live report, the listing is linked to infostealer activity detected by HudsonRock, in which credentials belonging to eight Starmark employees and 17 third-party employees were compromised. An exposure report from ParanoidLab identified 198 passwords connected to the incident, 39 of them classified as critical, along with 17 cookies. The company's domain records also show it uses Microsoft 365 as a cloud service.

Claim remains unverified

Neither report confirms that Starmark's systems were encrypted, that corporate data was stolen, or that a ransom was demanded. No operational disruption has been reported, and no evidence has been published to show how far any intrusion went. At this stage the listing is a claim by the group, not an independently verified breach.

Even so, the credential exposure is the part defenders will focus on. Infostealer malware that harvests employee logins is a common first step before a ransomware attack, giving intruders the valid accounts they need to move through a network. Security teams are advised to reset passwords for any staff or contractors named in exposure reports, watch Microsoft 365 and other cloud logins for unusual activity, enforce multi-factor authentication on every account, and tighten access for third-party users.

The claim comes during a busy month for ransomware listings. HackerFeeds, which aggregates data from Ransomware.live, recorded 275 victims claimed on leak sites so far in November 2026, with LockBit5 accounting for six of them, in figures updated on 9 November. Manufacturing has been one of the most targeted sectors this year, and the Starmark listing is a reminder that furniture makers and other mid-sized manufacturers are firmly in scope.