BRIEFRansomwarehighP65
Qilin ransomware lists Mexico's Revi Group
Revi Group (México)
Detected23 October 2026 · 16:14 UTC
The Qilin group added Revi Group, a Mexican organization, to its ransomware leak site. Publication signals a claimed breach with data theft and likely encryption of internal systems. Any Mexican victim in the region is relevant for defenders monitoring Qilin's LATAM activity and potential credential or data reuse.
CategoryRansomware
Severityhigh
Priority score65
Detected23 October 2026 · 16:14 UTC
Ransomware● 68
Qilin publica a la argentina MaxiSeguridadThe Qilin ransomware group has added MaxiSeguridad, an Argentine professional services company, to its leak site. A fresh regional victim matters because private security and services providers typically hold sensitive client data and privileged access to customer environments. Even without published file details yet, extortion of this profile often escalates into data leaks affecting third parties.Ransomware● 72
Whitearmor publica filtración de datos de WhirlpoolWhitearmor listed Whirlpool, a ~$15.5B appliance manufacturer, claiming 4,577 employee records from three plants, 374 corporate emails, roughly 22,000 SAP invoice records and full plant contact lists. SAP invoice and manager/cost-center data directly enable invoice fraud and targeted phishing against suppliers and staff. The named plants and AD-style usernames also give attackers a roadmap for internal reconnaissance.Ransomware● 76
Whitearmor publica a la logística J.B. HuntWhitearmor published J.B. Hunt, a major North American logistics company, claiming 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices and 973 M365 mailboxes, with a $5M demand. The volume of identity and financial data makes business email compromise, supplier fraud and credential stuffing highly likely. The same leak is being promoted on BreachForums as a downloadable collection.Ransomware● 72
Qilin publica a la transportista chilena Aerotop como víctimaQilin has named Aerotop, a Chilean transportation company, on its extortion leak site. For a logistics/transport operator, exposed data can include operational systems, client contracts and route or shipment records. Disruption to such a firm can ripple through Chilean transport and supply chains, warranting exposure checks.Ransomware● 80
Qilin publica a la argentina Aryza como víctima de ransomwareThe Qilin ransomware group has added Aryza, an Argentine technology company, to its leak site. Publication implies data was likely exfiltrated and encrypted, exposing customer or internal records. A local tech provider can be a supply-chain foothold into Argentine businesses, so defenders should check for exposure and credential reuse.Ransomware● 44
Ransomware Akira publica a Bankruptcy Software SpecialistsThe Akira ransomware group has listed Bankruptcy Software Specialists, a US firm providing trust-fund management software to bankruptcy trustees, and claims it will upload 19GB of corporate data. Such software vendors sit close to sensitive financial and legal records of debtors and trustees. A compromise here risks downstream exposure of client law firms and financial data, not just the vendor itself.