BRIEFRansomwarehighP70
SpaceBears ransomware hits Colombian auto parts maker Anpra SAS
Anpra SAS
Detected21 July 2026 · 09:58 UTC
The Colombian auto parts company Anpra SAS has been victimized by a ransomware attack carried out by the SpaceBears group. Internal data, and possibly customer and operational information, have been leaked. This incident highlights the growing threat to companies in the automotive sector in Latin America, impacting business continuity and supply chain security.
CategoryRansomware
Severityhigh
Priority score70
Detected21 July 2026 · 09:58 UTC
Ransomware● 73
Ransomware incransom publica a la cooperativa costarricense CoopecajaThe incransom ransomware group listed Coopecaja, a Costa Rican savings-and-credit cooperative (coopecaja.fi.cr), as a victim, exposing a LATAM financial-services entity. This is a fresh victim post in the banking/credit-union sector of the region, a high-value target for extortion and downstream fraud. Defenders in Costa Rican financial services should treat this as an active leak event and check for related credential or data exposure.Ransomware● 40
Qilin publica a la británica Kemlows Diecasting ProductsQilin has published Kemlows Diecasting Products Limited, a UK manufacturing firm, as a ransomware victim. The listing indicates stolen data and potential production disruption, affecting automotive and industrial supply chains. It is a fresh victim publication relevant for third-party and supply-chain risk monitoring outside Latin America.Ransomware● 45
Qilin publica a la japonesa Keio Corporation como víctimaRansomware group Qilin has listed Keio Corporation, a Japanese transportation company, on its leak site. Transportation is critical infrastructure, and the publication signals data theft and likely operational disruption if talks fail. It matters as a fresh ransomware victim for sectoral and supply-chain awareness, even outside the region.Ransomware● 66
Ransomware Qilin publica a Telcoe Federal Credit UnionThe Qilin ransomware group has listed Telcoe Federal Credit Union, a US financial services victim, on its leak site. Fresh ransomware listings signal an active extortion operation where stolen member and financial data may be published if the ransom is not paid. Financial-sector defenders should treat this as an early warning and monitor for downstream fraud and credential abuse.Ransomware● 35
Ransomware iah6477 publica a la alimentaria Hilmar Cheese (EE.UU.)The iah6477 ransomware group has listed Hilmar Cheese, a US dairy producer, with roughly 719 GiB of claimed exfiltrated data. Food and agriculture victims raise supply-chain and operational-disruption risks. It is outside the AR-LATAM region, so it is a lower-priority item for local defenders but notable in scale.Ransomware● 42
Ransomware Qilin publica a la tecnológica española Segres SystecQilin has listed Segres Systec, a Spanish technology company, as a ransomware victim. Technology providers often hold privileged access into customer environments, so a breach here can cascade to downstream organizations. Spanish-speaking defenders should assess third-party exposure and monitor for leaked data.