gruposelpe.com.br Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 7, 2026, the ransomware group lockbit5 listed gruposelpe.com.br on its leak site and stated that internal files had been exfiltrated. The number of individuals whose information may be involved is not known, and no further details on the volume or contents of the material have been released publicly. For people whose records are held by a human-resources consultancy, the incident raises the possibility that personal and employment-related information could circulate beyond the original organization.

Inside the incident

The only confirmed public information is the listing itself and the claim that files were taken during a ransomware operation. No date of the intrusion, no count of records, and no description of the access method have been disclosed. The organization has not issued a statement confirming or disputing the listing, and independent verification of the material has not been reported.

The group behind it: lockbit5

LockBit operates as a ransomware-as-a-service group that supplies encryption tools to affiliates in exchange for a share of ransom payments. The group commonly exfiltrates data before encryption and posts samples or directories on a dedicated leak site to pressure victims. It has appeared in multiple law-enforcement alerts and has targeted organizations across sectors and countries. In this case the group claims responsibility for the action against gruposelpe.com.br; that claim has not been corroborated by the victim or by investigators.

About gruposelpe.com.br

Gruposelpe.com.br is the online presence of Selpe Consultoria de RH, a Brazilian firm that provides human-resources and people-management services. Organizations of this type routinely collect and store employee records on behalf of client companies, including recruitment files, payroll data, performance evaluations, and contact details. A compromise at such a provider can therefore affect both the consultancy’s own staff and the workforces of its clients.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, no sample data, and no confirmation of specific categories have been published. Human-resources consultancies typically hold names, national identification numbers, bank details, employment histories, and sometimes medical or benefits information. Whether any of these categories are present in the material claimed by lockbit5 remains unconfirmed.

Why it matters

Employment and payroll records can be used for identity fraud, targeted phishing, or unauthorized access to linked financial accounts. When the records belong to multiple client organizations, the scope of potential exposure widens without any single employer necessarily being aware. For the consultancy, the incident may affect client trust and trigger regulatory obligations under Brazilian data-protection rules, though the precise obligations depend on facts that have not yet been made public.

If your data was in this claimed breach

Individuals can take the following steps while waiting for official notification:

• Review bank and benefits statements for unusual activity.
• Enable multi-factor authentication on accounts that store employment or financial information.
• Request a copy of personal data held by current or former employers and the consultancy itself.
• Run a free exposure scan of their email address against known breach data sets to see whether their information appears in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.