Lockbit5 ransomware group lists instapack.es on its leak site

• Ransomware group: Lockbit5
• Country: Spain
• Sector: Professional Services
• Announcement date: April 29, 2026

The Spanish courier and logistics service provider instapack.es has been listed on the leak site of the LockBit ransomware group. The threat actor claims to have compromised the organization and has threatened to publish the institution's data if certain conditions are not met.

The details of the claim

According to the announcement made on the LockBit leak site, the group added instapack.es to its list of victims on April 28, 2026. The threat actor has set a deadline of May 13, 2026, for the organization to comply with their demands, after which they claim they will publish the institution's data.

The announcement provided by the group includes general information regarding the operations of the institution, but it does not provide specific details regarding the allegedly leaked data. As of the time of the announcement, the group has not disclosed the volume of data or the specific file counts involved in the incident.

Data involved in the incident

Regarding the content of the alleged breach, the listing names no specific data types or specific information that has been exfiltrated.

Organization profile

Instapack is a professional courier and logistics services company based in Spain. With over 30 years of experience, the company specializes in providing immediate delivery solutions to its clients.

Threat actor analysis and potential impact

The LockBit group is a known threat actor that has been active since 2019. Operating under a Ransomware-as-a-Service (RaaS) model, the group is known for its sophisticated operations. It is reported that the group resumed its operations with a new version following a significant disruption to its infrastructure in February 2024.

Ransomware groups frequently employ double extortion tactics. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to leak confidential information, the attackers aim to pressure the victim into paying a ransom to prevent the public exposure of their data.

Because the affected institution is based in Spain, a confirmed data breach could trigger mandatory notification obligations under the General Data Protection Regulation (GDPR). The exposure of sensitive information, such as customer or employee data, can lead to significant secondary risks, including identity theft and the execution of targeted phishing attacks against the individuals involved.

Given that the institution provides specialized courier and logistics services, there is a potential risk to logistics data and customer contact information. Such a breach could impact the operational continuity of the company. In the logistics sector, maintaining the integrity and confidentiality of delivery and contact information is vital for service reliability and trust.

Organizations facing such threats often focus on defensive measures such as implementing robust backup strategies, enforcing multi-factor authentication, and maintaining strict network segmentation to limit lateral movement. Continuous monitoring and rapid incident response capabilities are also essential for mitigating the impact of such high-level threats.