Terra-Petra Data Breach

LockBit 5 ransomware has allegedly targeted Terra-Petra, a German company operating in the energy and utilities sector. The claim was posted on LockBit 5’s dark web portal on August 18, 2026, and was identified by SOCRadar’s Dark Web Monitoring service. While this is an unverified claim and Terra-Petra is listed as an alleged victim, the incident highlights the ongoing threat of ransomware attacks against critical infrastructure and industrial organizations. The company’s operational domain is terra-petra[.]com. In the 60 days preceding this listing, LockBit 5 claimed 24 other victims, with a notable focus on the Manufacturing, Technology, and Professional Services sectors. The group has shown a strong concentration in Europe, particularly targeting Germany, France, and Italy. Recent German victims attributed to LockBit 5 include Verbandsgemeinde Rhein-Nahe, TECOSIM, ComTRI GmbH, and Gies Dienstleistungen GmbH. Terra-Petra’s presence in Germany aligns with this regional focus. Although the energy and utilities sector is less frequently targeted by LockBit 5 compared to manufacturing, European critical infrastructure has seen increasing attention from ransomware actors in 2026.

A query of stealer-log data associated with the domain terra-petra[.]com returned no records within the specified sample. It is important to note that this result does not definitively confirm that the organization has not been compromised. The absence of evidence in this particular query scope is limited; credentials could potentially exist under alternate corporate domains, associated subdomains, or within data feeds not included in this dataset. Furthermore, any discovered credentials might have been used and subsequently rotated before their indexing in the queried sources. The lack of direct correlation from the stealer-log query means that no specific initial access path can be identified based on this telemetry alone. This does not rule out the possibility of unauthorized access or compromise through other means. The pattern of LockBit 5’s listings remains consistent with their documented European campaign, and Terra-Petra’s German base aligns with the group’s geographic targeting. While the energy and utilities sector is not a primary target for LockBit 5, the increasing ransomware activity against European critical infrastructure in 2026 indicates a potential shift in focus. Further investigation should include re-running stealer-log queries against terra-petra[.]com with a broader scope, encompassing associated subdomains. Additionally, it is recommended to audit VPN, RDP, and Microsoft 365 sign-in logs for any anomalous access patterns in the 30 days preceding August 18, 2026. Relevant stakeholders should be notified according to internal incident classification procedures, and continuous monitoring of LockBit 5’s leak portal for any data publication related to Terra-Petra is advised.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.