[ Ransomware claim · lockbit5 · 23 Oct 2026 ]
zelsior.es
The ransomware group lockbit5 named zelsior.es (Spain) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from zelsior.es and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is zelsior.es?
- What it does
- Zelsior is a Spanish legaltech and legal services company specialising in debt and credit recovery through the courts. It manages court procedures, legal back-office work, document management and a network of court representatives (procuradores), using its own AI software called Lyra to automate high-volume cases. It was formed when Atlante and Proinvest, which Atlante bought in 2022, completed their merger under the Zelsior brand in 2024.
- Based in
- Madrid and Barcelona, Spain
- Founded
- 2015
- Size
- more than 200 employees, handling over 18,000 court notifications a day
- Who it serves
- Its clients are banks, investment funds and private and public companies across Spain that need to recover debts or manage legal proceedings at scale.
Partners and customers it names publicly
- Angeco, industry partner shown on Zelsior's website
- Global LegalTech Hub, industry partner shown on Zelsior's website
[ Impact ]Who could be affected
Banks and investment funds that use Zelsior could see delays to court filings and debt recovery cases if its systems were disrupted. Because the company handles court documents in debt cases, people who are parties to those proceedings could have personal and financial details exposed if any data was accessed. Lawyers and procuradores who work with the firm could also face delays to case work.
In this kind of organisation generally: Customers, employees and partners can be affected: services can be interrupted, and personal or business data the organisation holds can be threatened with publication.
[ The attacker ]About lockbit5
LockBit is a long-running ransomware-as-a-service operation whose affiliates steal data and encrypt systems, then publish data from victims who do not pay. Its current LockBit 5.0 version targets Windows, Linux and VMware ESXi, and the group has kept operating largely unchanged after the Operation Cronos law enforcement action.
lockbit5 has claimed 24 organisations in the last 30 days, most in United States, Thailand and Mexico, and mostly in other, professional services and financial services.
Other organisations lockbit5 has named
- Brazil
- Indonesia
- Thailand
- Mexico
- Italy
[ What to do ]If you are a customer, partner or neighbour
- If you are a party to a debt case handled by Zelsior, be wary of calls, emails or letters demanding urgent payment and verify them with the creditor or the court using contact details you already hold.
- Never pay a debt into a new or changed bank account without confirming it independently.
- Client institutions should ask Zelsior for an update on the incident and check which case files and data they share with it.
- Watch for phishing that uses real case numbers or court references to appear genuine.