BRIEFRansomwarehighP68
Aurora ransomware publishes Italian manufacturer Ernesto Malvestiti
Ernesto Malvestiti S.p.A.
Detected26 October 2026 · 09:41 UTC
The Aurora ransomware group has published Ernesto Malvestiti S.p.A., an Italian precision aluminium die-casting manufacturer supplying BMW, Stellantis, Valeo and other automotive OEMs, after an apparent breach. Stolen material reportedly includes a 1.1 GB PAGHENET payroll SQL Server backup (multiple copies) exposing every employee's salary, IBAN, and bank details. This supplier compromise matters for automotive OEMs whose third parties hold sensitive employee and commercial data.
CategoryRansomware
Severityhigh
Priority score68
Detected26 October 2026 · 09:41 UTC
Ransomware● 42
Ransomware Qilin publica a la constructora estadounidense Seufert ConstructionQilin published US construction firm Seufert Construction on its public leak site. Construction firms hold project, contractor and client records that can drive business-email-compromise and vendor fraud. It sits outside Latin America but reinforces Qilin's broad cross-sector targeting.Ransomware● 42
Ransomware Qilin publica a la firma estadounidense Miller StratvertThe Qilin group listed Miller Stratvert, a US company, on its leak site. Such victims often expose internal email, legal or client records that fuel further extortion and fraud. Outside Latin America, but useful for tracking Qilin's steady publication cadence.Ransomware● 44
Ransomware Qilin publica al minorista francés BCSA GearQilin added French retail/e-commerce firm BCSA Gear to its public extortion site. Retail victims typically expose customer accounts and payment-adjacent data useful for follow-on fraud. It is outside Latin America but shows continuing Qilin pressure on European retailers.Ransomware● 46
Ransomware Qilin publica a la manufacturera japonesa Nissho ElectricQilin published Nissho Electric Manufacturing Co., a Japanese manufacturer, on its leak site. Manufacturing victims can expose operational technology, supplier and client data that enable further industrial attacks. It is outside Latin America but relevant to tracking Qilin's global targeting of industrial firms.Ransomware● 50
Ransomware Qilin publica al distrito escolar Burnaby Schools de CanadáThe Qilin ransomware group added Burnaby Schools, School District 41 in Canada, to its public leak site. Education districts hold student and staff personal data and sensitive records, making them attractive for extortion and downstream identity fraud. The victim is outside Latin America but signals ongoing Qilin activity in education.Ransomware● 53
Ransomware Majinahanashi publica al fabricante Bi-silqueThe Majinahanashi ransomware group has added Bi-silque, a Portuguese office and presentation-equipment manufacturer (listed as US-based), to its leak site. This confirms an active extortion incident with potential theft of internal corporate data and disruption to manufacturing operations. Defenders in manufacturing and supply chains should watch for related exfiltration and supplier-impact risk.