Two organizations in unrelated sectors and on different continents were added to ransomware leak sites on August 16, 2026. UnderCode News, citing threat intelligence monitoring by ThreatMon, reports that the Helix ransomware group listed US engineering and infrastructure consultancy Kennedy Jenks, timestamped at roughly 18:00 UTC+3, while Italian agricultural firm Agricola Galbusera was added to the LockBit 5 victim list. Both listings are criminal claims on extortion portals. Neither company has published a statement, no regulator filing has surfaced, and no national CERT or vendor advisory has corroborated either intrusion. Readers should treat the specifics accordingly: what is documented here is that the names appeared, not that the attacks unfolded as the operators describe.
One sourcing note up front. The Kennedy Jenks and Agricola Galbusera listings rest on a single OTHER-tier report relaying a monitoring feed. Everything else in this brief, including LockBit 5 victim volumes, sector patterns, and Italian targeting data, comes from independent trackers and security press covering the same operations over the preceding six weeks. That contextual material is well corroborated. The two headline listings are not.
What Happened
On August 16, 2026, ThreatMon's monitoring surfaced Helix as the claiming actor against Kennedy Jenks, an engineering and infrastructure consulting company whose work spans water, environmental services, and construction advisory. UnderCode News describes the detection as a leak-site addition rather than a confirmed encryption event, and does not report a ransom demand, a data volume, or an intrusion date.
Separately, Agricola Galbusera appeared on LockBit 5's portal. The single source describing this listing characterizes Galbusera as an Italian agricultural company; the framing of the firm as a food manufacturer specifically is not something the available sourcing establishes, and defenders tracking this should verify the entity and sector independently before treating it as fixed.
The wider pattern around both listings is better documented. SOCRadar's dark web monitoring recorded LockBit 5 claiming 76 other victims in the 60 days preceding August 3, 2026, a cadence visible in the group's batch postings that swept up Italian plastics manufacturer SIRSA S.p.A. and Delkart Industries Limited on the same day. HookPhish logged UK engineering equipment manufacturer Briggs, trading since 1740, with a breach date of August 4 and discovery on August 5. Today In Cyber recorded a further LockBit 5 posting against bancrofteng.com. In the healthcare sector, MedRisk reports that Decatur Diagnostic Laboratory in Alabama filed a hacking incident involving data exfiltration with the HHS Office for Civil Rights, and that LockBit 5 claimed responsibility and posted the lab to its leak site, though the laboratory itself has not confirmed ransomware.
Accounts differ on how central Italy is to LockBit 5's operations. SOCRadar's tracking of the group's recent activity puts Brazil, the United States, and Germany as its most frequently targeted countries, with Italy appearing less often among the top victim nations. Security Affairs, reporting on the ransomNews RedACT semi-annual tracker, has LockBit 5 and Qilin leading ransomware activity against Italian organizations in the first half of 2026. Both can be true at once: Italy can be a secondary theater for LockBit 5 globally while LockBit 5 is a primary actor within Italy. The distinction matters when you are sizing regional risk.
What Was Taken
Nothing is established. No source reports a data volume, record count, file listing, or sample release for either Kennedy Jenks or Agricola Galbusera. The exposure discussion in the available reporting is inference from the victims' business profiles rather than observation of leaked material.
For an engineering and infrastructure consultancy such as Kennedy Jenks, the categories at plausible risk are project documentation, engineering drawings and technical designs, internal communications, client records, and employee data. UnderCode News notes that for firms operating around infrastructure, environmental services, and construction, technical documents become a second lever for extortion beyond simple encryption, because their disclosure can implicate client sites and third parties who were never breached themselves.
The regional data offers the only quantitative anchor. Per the ransomNews figures relayed by Security Affairs, attackers claimed 13,405.22 GB, roughly 13.4 TB, stolen from Italian organizations across 148 confirmed claims in H1 2026. Critically, a volume was disclosed in only 64 of those 148 cases, 43.2 percent, and where reported the average was 61.1 GB. Security Affairs is explicit that these are marketing claims from criminals rather than audited disclosures, and that gap between claims and verification is the correct default posture toward any figure that eventually appears alongside the Kennedy Jenks or Galbusera listings.
SOCRadar's stealer log telemetry returned no records for sirsa.it or delkartindustries.com. The firm cautions that a null result does not clear an organization, since the queries cover a paginated sample and would miss alternate corporate domains, third party subdomains, and credentials captured under employees' personal email aliases.
Why It Matters
The volume behind these two names is the story. LockBit 5 posting 76 victims in a 60 day window is an industrialized intake rate, and the composition of that intake is consistent: SOCRadar identifies manufacturing, business services, and hospitality and tourism as the group's leading target sectors. The Italian data reinforces it, with manufacturing the most targeted sector across 148 claims and a heavy geographic concentration in the industrial north. Northwest Italy alone accounts for 63 victims, 42.6 percent, followed by the Northeast with 36, Central Italy with 30, the South with 13, and the Islands with 5. Lombardy carries 45 victims and the province of Milan 22 on its own. That is roughly 25 claims a month against Italian targets, just under six a week.
An agricultural or food sector victim in Italy fits this profile precisely. So does an infrastructure engineering firm in the US, where the value is less about halting production and more about the sensitivity of what sits in the document management system. Kennedy Jenks' involvement in water and critical infrastructure work is what elevates a routine leak-site posting into something worth watching, because engineering consultancies hold detailed technical material about facilities operated by other people. The blast radius of an engineering firm's document store is not bounded by the firm.
The MedRisk reporting on Decatur Diagnostic Laboratory shows the same dynamic in another vertical: a claimed victim that has confirmed data theft to a regulator, including names, dates of birth, Social Security numbers, driver's license numbers, medical record numbers, and patient codes, while stopping short of confirming ransomware. Leak-site attribution and victim confirmation frequently diverge, and the gap can persist for months.
The Attack Technique
No initial access vector has been reported for either listing. Neither Helix nor LockBit 5 has published intrusion detail, and no forensic account exists in the available sourcing.
What is documented is the access surface these operations draw from. Today In Cyber's reporting notes that multiple threat actors have been exploiting CVE-2026-0257, a critical authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portal and gateway, since approximately May 17, 2026. The flaw lets unauthenticated attackers forge authentication override cookies and establish unauthorized VPN sessions, stemming from a misconfiguration in which the certificate used for override cookies was also used for the GlobalProtect HTTPS service. CISA has added it to the Known Exploited Vulnerabilities catalog, mandating federal patching and advising equivalent urgency elsewhere. The same reporting covers ShinyHunters, tracked as UNC6240, exploiting CVE-2026-35273, a CVSS 9.8 unauthenticated remote code execution zero day in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 since at least May 27, 2026, against more than 100 organizations.
Credential theft remains the other pillar. Operation Endgame disrupted StealC, Amadey, and SocGholish infrastructure, seizing 326 servers, 142 domains, roughly 27 million stolen login credentials, and over USD 47 million in cryptocurrency, while remediating approximately 15,000 compromised WordPress sites that fed the initial access pipeline for ransomware groups. HookPhish, reporting on the Briggs listing, states plainly that most ransomware intrusions begin with a stolen password or a phishing email. Absent specific evidence, exposed edge devices and valid stolen credentials remain the most probable entry paths for both incidents.
What Organizations Should Do
- Patch and audit the VPN edge immediately. CVE-2026-0257 in PAN-OS GlobalProtect is in CISA's KEV catalog with confirmed multi-actor exploitation since mid-May 2026. Patch, then verify that the certificate used for authentication override cookies is not shared with the GlobalProtect HTTPS service, and hunt retrospectively for VPN sessions that were never preceded by a genuine authentication event.
- Treat Oracle PeopleSoft as a live target. PeopleTools 8.61 and 8.62 are exposed to CVE-2026-35273, an unauthenticated RCE already used against 100 plus organizations. Inventory instances, apply Oracle's fix, and check for custom payloads and data staging on affected hosts.
- Assume credential exposure rather than testing for it. SOCRadar's null stealer-log results for two claimed victims came with an explicit warning that the sample is partial and misses alternate domains, third party subdomains, and personal email aliases. Enforce phishing-resistant MFA on every external service, rotate credentials for privileged and remote access accounts, and monitor for infostealer logs continuously rather than as a one-off query.
- Segment and instrument the document estate. For engineering, consulting, and design firms, project files and technical drawings are the extortion asset. Restrict bulk read access, alert on large-volume reads from document management and file shares, and cap egress paths so a mass export looks anomalous before it completes.
- Harden manufacturing and OT adjacency. With manufacturing the leading target sector for both LockBit 5 globally and ransomware against Italy specifically, enforce hard boundaries between production planning, ERP, inventory, and logistics systems and the corporate IT estate, and rehearse operating those production processes with IT unavailable.
- Write the leak-site scenario into your incident plan. Decide in advance who confirms or declines to confirm a claim, what a regulator filing requires under HIPAA, GDPR, or state law, and how you brief clients whose data sits in your systems. The Decatur Diagnostic Laboratory case shows regulator notification and public ransomware confirmation moving on separate tracks.
- Discount criminal figures by default. Volume claims were disclosed in fewer than half of Italian cases, and Security Affairs frames those numbers as marketing copy. If a data volume attaches to either of these listings, verify it against your own telemetry before it drives your response.
Sources: Helix and LockBit 5 Strike Again: Kennedy Jenks and Agricola Galbus... | LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organiza... | SIRSA Data Breach Technology Data Breach Intelligence SOCRadar®... | Someone Claims LockBit5 Ransomware Hit Italian Plastics Manufacture... | Ransomware Group lockbit5 Hits: briggsplc.com | Delkart Industries Limited Data Breach Manufacturing Data Breach... | 🏴☠️ Lockbit5 has just published a new victim : bancrofteng.com To... | 83K exposed in email hack as LockBit 5 surfaces and healthcare brea...