[ Ransomware claim · lockbit5 · 23 Oct 2026 ]
mlh.com.lb
The ransomware group lockbit5 named mlh.com.lb (Lebanon) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from mlh.com.lb and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is mlh.com.lb?
- What it does
- mlh.com.lb is the website of Mount Lebanon Hospital University Medical Center, a private hospital in Beirut. It offers outpatient care, maternity, home care, a range of medical departments and laboratory and radiology services, and says it holds Joint Commission International Gold Seal accreditation.
- Based in
- Beirut, Lebanon
- Founded
- 1995
- Size
- more than 800 medical professionals
- Who it serves
- Patients from across Lebanese society in Beirut and the surrounding area, including people needing maternity, emergency, outpatient and specialist care.
Partners and customers it names publicly
- University of Balamand, Manages the hospital as its university medical center
[ Impact ]Who could be affected
Patients could face delayed appointments, test results or procedures if hospital systems were disrupted. If patient information was exposed, patients could be at higher risk of fraud or phishing that uses their medical details.
In professional services generally: Law firms, accountants and consultants hold their clients' confidential documents, so clients can be exposed even when they were never attacked themselves.
[ The attacker ]About lockbit5
LockBit is a long-running ransomware-as-a-service operation whose affiliates carry out attacks with malware supplied by its core developers. After a 2024 law enforcement disruption it released LockBit 5.0 in September 2025, with versions for Windows, Linux and VMware ESXi.
lockbit5 has claimed 24 organisations in the last 30 days, most in United States, Thailand and Mexico, and mostly in other, professional services and financial services.
Other organisations lockbit5 has named
- Brazil
- Indonesia
- Thailand
- Mexico
- Italy
[ What to do ]If you are a customer, partner or neighbour
- Be cautious of calls, texts or messages about appointments, results or payments that you were not expecting, and check them with the hospital on its published number.
- Do not share bank card details or identity documents with anyone who contacts you unprompted claiming to be from the hospital.
- Use the hospital's official website for online laboratory and radiology results rather than links sent in messages.
- If you have reused the password from your hospital patient account elsewhere, change it.