BRIEFRansomwarecriticalP82
BrainCipher ransomware hits Argentine clinic Clínica Romero
clinicaromero.com
Detected21 October 2026 · 21:36 UTC
BrainCipher ransomware listed clinicaromero.com, a healthcare provider in Argentina, on its leak site. Healthcare is critical infrastructure, so exposed patient records, PII and disrupted services carry real risk. Argentine and regional defenders should treat this as a live incident and check for exposure.
CategoryRansomware
Severitycritical
Priority score82
Detected21 October 2026 · 21:36 UTC
Ransomware● 54
Ransomware Interlock publica al Coastal Alabama Community CollegeInterlock published the US community college after claiming it ignored the intrusion, alleging student education records, protected health information, financial aid data, employee files, SSNs and card data were taken. Education-sector victims usually face long notification cycles and heavy PII exposure. Useful for monitoring stolen student and financial-aid datasets resurfacing for sale.Ransomware● 60
Ransomware Aurora publica al fabricante británico Allmand-Smith (Stormguard)Aurora listed the UK building-products manufacturer with claimed domain admin credentials and a full domain controller dump, plus a live NatWest Bankline database with account and payee data. That combination of AD compromise and banking access is a template for fraudulent payment redirection. Financial institutions and UK suppliers should treat it as active threat intel.Ransomware● 45
Ransomware SilentRansom publica al bufete Porter Hedges LLPSilentRansom group listed US law firm Porter Hedges LLP as a ransomware victim via ransomware.live. Law firms hold sensitive client and deal data, including energy-sector matters, making them attractive extortion targets. The listing signals an active leak-site publication; monitor for the eventual data release.Ransomware● 52
El ransomware Helix publica a la cafetera Westrock CoffeeRansomware group Helix has listed Westrock Coffee, a US coffee supplier with roughly $1.2bn annual revenue, on its leak site. Links and passwords unlock in 24 hours, so the window to verify stolen data and assess supply-chain exposure is short. It sits outside Latin America but the victim's size makes it useful for sector and partner alerts.Ransomware● 40
Ransomware Akira publica a la minorista Cascade Flooring AmericaAkira listed US flooring retailer Cascade Flooring America with a threatened 50GB leak of corporate data and employee personal information. It is a fresh named victim but small, US-based and outside the AR-LATAM focus, so it ranks low for immediate alerting.Ransomware● 52
Ransomware Akira publica al fabricante de PCB Flextron Circuit AssemblyAkira listed Singapore-based PCB manufacturer Flextron Circuit Assembly and threatens to release 34GB of corporate data, including employee passports, driver's licenses, financials and NDAs. The exposure of identity documents and supplier contracts makes this relevant to electronics supply-chain defenders, though the victim is outside Latin America.