Poole Group Data Breach

LockBit 5 has listed Poole Group, an Australian professional services firm, on its leak portal as of October 14, 2026. This listing aligns with LockBit 5’s operational pattern of targeting the professional services sector. However, Poole Group’s location in Australia deviates from the ransomware group’s typical geographic focus, which predominantly includes Germany, the United States, and the Netherlands. In the 60 days leading up to this listing, LockBit 5 claimed 44 other victims, with a strong emphasis on the professional services and healthcare industries. Notable recent victims exhibiting similar profiles include Consilio (US), Alpha Omega Engineering (Germany), Forus (Chile), and VSB Attorneys Inc (South Africa), all operating within the professional services domain. These firms are often targeted due to their handling of high-value advisory relationships and sensitive client data. The threat actor’s strategy of publishing data rather than engaging in negotiation can expose clients to significant reputational and legal repercussions.

A query for stealer-log records associated with the domain poolegroup.com[.]au returned no findings. It is crucial to note that this query covers a specific dataset and may not encompass all potential credential exposures. Credentials might exist within other data feeds, associated with different corporate domains, or originate from employee personal email addresses. The modus operandi of LockBit 5 typically involves initial access brokers who source credentials from underground markets. These credentials are then validated against platforms such as Microsoft 365 or VPN portals before being handed off for ransomware deployment. Therefore, the absence of immediate stealer-log records does not preclude the possibility of compromised credentials or an active intrusion pathway. Recommended Response Organizations are advised to expand their monitoring to include subsidiary and employee personal domains for stealer-log activity. It is also recommended to audit active Microsoft 365 and VPN sessions for any anomalous login attempts originating from unexpected geographical locations or devices. Furthermore, stakeholders should inform cyber insurance providers and legal counsel about the public listing, as such publications can trigger disclosure obligations irrespective of a confirmed breach.