Micropack Data Breach

Micropack, a manufacturing company based in Argentina, has been listed as a victim on the LockBit5 ransomware group’s dark web portal, with the listing published on August 3, 2026. This incident was identified through SOCRadar’s Dark Web Monitoring service. The organization operates within the manufacturing sector in Argentina and was listed alongside a Brazilian victim, marking it as one of two Latin American entities in the same batch of LockBit5 claims. In the 60 days preceding this listing, LockBit5 had claimed 76 other victims. The group has demonstrated a consistent targeting pattern towards the Manufacturing, Business Services, and Hospitality and Tourism sectors. Geographically, their victims are primarily located in Brazil, the United States, and Germany. Previous LockBit5 listings involving manufacturing organizations in various regions, such as Venelectronics, Union Chemical, Param Packaging, and DRC, show a similar profile to Micropack. While the group’s focus on manufacturing is evident, and its presence in Latin America is largely centered in Brazil, this listing in Argentina represents a regional expansion rather than a deviation from its typical modus operandi.

SOCRadar’s analysis of stealer-log telemetry revealed a significant exposure related to the micropack.com.ar domain. All four records queried indicated that a single corporate identity was associated with third-party services, with no records found against the organization’s own infrastructure within this specific sample. One observed endpoint was an administrative login path on an external business platform, suggesting the account held privileged access to services outside Micropack’s direct control. The observed activity spanned from September 2, 2025, to June 6, 2026, showing a persistent credential exposure over approximately nine months without evidence of rotation. The dominant risk identified was workstation compromise, consistent with a persistently infected endpoint. However, the absence of internal system records in this dataset does not preclude compromise of on-premises or cloud identity infrastructure. For ransomware groups like LockBit5, infostealer-harvested credentials are a known initial access vector. Threat actors or initial access brokers acquire recent logs from underground marketplaces, validate corporate credentials, and use them to gain access to Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the stealer-log evidence does not definitively confirm that these specific credentials were used by LockBit5, the observed pattern aligns with the typical kill chain for such incidents. An employee’s workstation exposing credentials over an extended period is a common source for initial access brokers. Standard response measures would include forensic imaging of the affected endpoint and credential rotation across all associated services.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.