BRIEFRansomwarehighP58
AuditTeam ransomware publishes new victim in Spain
Ca***ka (Spain)
Detected23 October 2026 · 11:36 UTC
Reposts collapsed2
The AuditTeam ransomware group has listed a Spanish company (name partially redacted, sector not disclosed) on its leak site. A new victim in Spain means potential data-theft extortion affecting local operations and customer records. Spanish-speaking defenders should verify exposure and monitor for leaked data reuse.
CategoryRansomware
Severityhigh
Priority score58
Detected23 October 2026 · 11:36 UTC
Ransomware● 36
Ransomware AuditTeam publica a la británica ADL Lift ServicesAuditTeam listed ADL Lift Services, a roughly 40-employee Scottish commercial lift specialist, on its leak site. Small UK manufacturers remain frequent targets, and a breach can disrupt its UK-wide 24-hour emergency call-out operations. Low regional relevance, but it confirms ongoing AuditTeam activity.Ransomware● 38
Ransomware AuditTeam publica a la italiana Zena OfficeAuditTeam listed Zena Office, a small Italian IT and office-technology provider serving local businesses and public-procurement clients. A compromise of an IT provider can cascade to its downstream customers, including public-sector buyers, creating supply-chain exposure. The firm is small but the third-party risk is worth noting.Ransomware● 56
Ransomware Scarlett publica a la CRM automotriz VinSolutions (EE. UU.)The Scarlett group listed VinSolutions, a US automotive CRM platform used by car dealerships, on its leak site. CRM data from such a platform can expose sales leads, customer PII and contact records spanning many third-party dealerships. Defenders in the automotive sector should watch for downstream phishing and credential-stuffing waves.Ransomware● 58
Ransomware FulcrumSec publica a la firma de datos EMARKETERFulcrumSec has published EMARKETER, a US market research and business intelligence firm, as a ransomware victim. Research firms hold large volumes of client and market data attractive for resale and competitive abuse. The listing is fresh and warrants validation of scope.Ransomware● 52
Ransomware Pear publica a la alimentaria Fresh FarmsThe Pear group has listed Fresh Farms, a US agriculture and food distributor, as a ransomware victim. Food supply chain targets carry operational disruption risk beyond the data theft itself. Victim details are thin but the listing is recent and should be tracked.Ransomware● 68
Ransomware Rhysida publica a la fabricante Line2Line CoatingsRhysida has listed Line2Line Coatings with nearly 800,000 files and 641 GB, including email archives, QuickBooks backups and banking statements with account numbers and card CVVs. This is a full-scale extortion leak with severe financial fraud exposure. Defenders should expect credential and banking data to surface.