BRIEFRansomwarehighP73
BYOD ransomware leaks data of 12 million Gate users
Gate | Crypto Exchange
Detected8 October 2026 · 00:07 UTC
The BYOD group claims to hold data on 12 million Gate crypto exchange users, including phone numbers, balances, VIP tiers, 2FA indicators, verification status and region. Such a leak fuels targeted phishing, account takeover and identity theft on a massive scale. A confirmed release would be high impact for the exchange and its customers.
CategoryRansomware
Severityhigh
Priority score73
Detected8 October 2026 · 00:07 UTC
Ransomware● 68
Ransomware BYOD publica a T-MobileBYOD ransomware listed T-Mobile, a major US telecom, claiming stolen data and threatening release unless the company makes contact. Telecom breaches expose subscriber data and can enable SIM-swap and network abuse. Although outside LATAM, it is a fresh high-value victim worth tracking for exposure of regional roaming and enterprise clients.Ransomware● 78
Ransomware DragonForce publica a la brasileña PetrosulDragonForce ransomware listed Petrosul, a Brazilian fuel distributor operating storage terminals in Sorocaba, Paulínia and Senador Canedo, hitting energy and utilities infrastructure. Disruption could affect fuel logistics and downstream business clients. Energy-sector victims in LATAM are prime targets that warrant immediate defensive review.Ransomware● 45
Ransomware IncRansom publica a la escuela The New Community SchoolThe IncRansom group listed The New Community School, an independent school in Richmond, Virginia serving grades 5-12, as a victim. Education-sector targeting is notable for student and staff PII exposure, though the victim is outside the Latin America region. Useful for tracking IncRansom activity and education-sector attack patterns.Ransomware● 48
Ransomware DragonForce publica a la constructora francesa RésoThe DragonForce ransomware group listed Réso, a French construction firm specialized in ceilings, partitions and technical floors with multiple agencies, as a victim. The victim is outside Latin America, so priority is lower, but it confirms active DragonForce operations in the technology/construction sector. Worth tracking for TTPs and possible regional spillover.Ransomware● 42
Ransomware Qilin publica a Qatar National Import & ExportQilin added Qatar National Import & Export to its leak site, a trading/import-export firm likely tied to Gulf logistics and government supply chains. Fresh ransomware listings signal active data theft that could expose commercial records, partner data and operational details. It is relevant to regional defenders tracking Qilin activity spreading across the Middle East and beyond.Ransomware● 66
Ransomware Qilin publica a la cárnica Matadero Frigorífico AvinyóThe Qilin ransomware group listed Matadero Frigorífico Avinyó, a Spanish meat-processing firm, on its leak site, threatening to publish stolen data. Freshly-named victims usually precede data dumps or follow-on extortion affecting operations, suppliers and food-supply chains. Defenders in Spain and across Spanish-speaking LATAM should monitor for leaked employee, customer and logistics data.