BRIEFRansomwarehighP45
shadowbyt3$ ransomware publishes US real estate firm John Engel Team
John Engel Team
Detected10 September 2026 · 06:14 UTC
The shadowbyt3$ ransomware group published John Engel Team, a US real estate and professional-services firm, on its leak site. The actor claims to hold serious data and shows an image as proof, indicating an active extortion. Freshly published victims are the earliest actionable signal for incident response and negotiation.
CategoryRansomware
Severityhigh
Priority score45
Detected10 September 2026 · 06:14 UTC
Ransomware● 45
Ransomware Anubis publica datos de Newcomer Cremations (EE.UU.)Anubis ransomware listed Newcomer Cremations, Funerals & Receptions, a US healthcare-sector firm, publishing customers' personal documents and internal files. Funeral providers hold highly sensitive identity and payment records of grieving families, ideal for identity theft and fraud. The listing follows the group's pattern of leaking data on publication.Ransomware● 72
Publican la base de datos de la Federación de Fútbol de Madrid (rffm.es)A forum user posted a database allegedly stolen from rffm.es, the Madrid Football Federation, tagged as a ransom leak and published minutes ago. Such dumps typically hold players, referees, clubs and staff contacts, ideal for targeted phishing and fraud. Federation records can include minors, raising GDPR and reputational exposure.Ransomware● 48
Ransomware Qilin publica a la neerlandesa SLTN Inter AccessThe Qilin leak site added SLTN Inter Access, a Dutch company, as a new victim, confirming at least claimed network compromise and data theft. Fresh Qilin listings typically precede extortion waves and often leak employee, customer and project data. Even outside Latin America, Qilin is active against Spanish- and Portuguese-speaking targets, making the TTPs and infrastructure relevant for regional defenders.Ransomware● 87
Ransomware n0n publica datos de la aseguradora de salud Asisken (Ecuador)The n0n group published data on Asisken, an Ecuadorian health insurance administrator, including identity documents and birth dates of 139,006 clients, 383,159 beneficiary records and 402,988 claims with diagnosis codes, current through 20 October 2026. This is a large, freshly updated LATAM healthcare/insurance breach exposing highly sensitive PII and medical data, enabling identity theft, fraud and regulatory exposure. Defenders should treat it as a live exposure given the October 2026 timestamps.Ransomware● 42
Ransomware Deadlock publica a la constructora Trinity Custom HomesThe Deadlock ransomware group has published Trinity Custom Homes, a US custom home builder operating across the Southeast, on its leak site. The listing implies stolen corporate data and possible encryption of design, contract and customer records, which can expose client PII and subcontractor details. It matters mainly as an indicator of Deadlock activity in construction and a source of leaked documents that may name third parties.Ransomware● 38
Ransomware Panzer publica a la ONG pakistaní Rahnuma-FPAPThe Panzer ransomware group listed Rahnuma-FPAP, one of Pakistan's largest reproductive-health NGOs, on its leak site. Healthcare NGOs hold sensitive patient data and typically run thin security budgets, making extortion pressure high. Relevant mainly as ransomware-trend context rather than a direct Latin American alert.