Gruposelpe.com.br listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Brazil
• Sector: Professional Services
• Announcement date: February 7, 2026

Lockbit5 claims attack on Selpe Consultoria de RH

The Lockbit5 ransomware group has listed the Brazil-based human resources consultancy firm Selpe Consultoria de RH on its leak site. According to an announcement published on February 7, 2026, the group claims to have targeted the gruposelpe.com.br domain. The post indicates that the institution was allegedly compromised on January 30, 2026. The group asserts that it has obtained the institution's data and has initiated a countdown process against the organization.

Ransomware attacks of this nature often involve a tactic known as double extortion. In such scenarios, threat actors do not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive information. The attackers then threaten to leak this stolen data on public platforms if the ransom demands are not met. This pressure tactic is designed to maximize the impact on the victim, moving the leverage from mere operational downtime to the threat of massive regulatory and reputational damage.

Details regarding the allegedly leaked data

At this stage, there is no specific information regarding the nature of the allegedly leaked data in the provided records or the screenshots associated with the announcement. The listing does not specify the volume of files or the total size of the data allegedly stolen by the attackers. Furthermore, no specific ransom demand has been made public in the current documentation.

The listing names no specific data types that have been compromised.

About Selpe Consultoria de RH

Selpe Consultoria de RH is a Brazil-based consulting firm specializing in human resources, personnel management, and recruitment processes. Given its core business functions, the firm handles significant amounts of sensitive information related to workforce management and professional recruitment.

Impact and potential risks

This incident may lead to disruptions in the institution's operational processes and the exposure of sensitive corporate data. As the institution operates in the human resources sector, the potential leakage of employee personal data could result in legal sanctions under Brazil's LGPD regulations. Secondary risks may include the use of leaked data for identity theft or targeted phishing attacks.

Lockbit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. It has been reported that the group returned with a new version after its infrastructure was disrupted in February 2024; this may indicate that the group maintains its operational continuity despite previous law enforcement interventions. Such persistence highlights the evolving nature of the threat landscape where sophisticated groups continue to develop new iterations of their malware to evade detection.

For organizations operating in the professional services and human resources sectors, maintaining robust defensive measures is critical. Common defensive steps include implementing multi-factor authentication (MFA) across all corporate accounts, maintaining offline backups of critical data, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, strict adherence to data protection frameworks, such as the LGPD, helps ensure that organizations are prepared to manage and protect the sensitive personal information that is central to their business operations.