BRIEFRansomwarelowP30
Ransomware group 'hyflock' publishes Vietnamese KTV club Dang Vuong Cac
dangvuongcac.com
Detected21 October 2026 · 12:52 UTC
The 'hyflock' group listed dangvuongcac.com, a high-end KTV/entertainment venue in Ho Chi Minh City, claiming to hold hotel-room and chat records. Relevance to Latin American critical infrastructure is low, but the data type (PII and chat logs) and the actor's ongoing activity are worth noting for broader tracking.
CategoryRansomware
Severitylow
Priority score30
Detected21 October 2026 · 12:52 UTC
Ransomware● 40
Hyflock publica al minorista gabonés GabonmecaThe 'hyflock' ransomware group claims gabonmeca.com, a large office-supplies and IT-equipment retailer and distributor in Gabon, as a victim. The company runs e-commerce and B2B ordering, so a leak would expose corporate customer contacts, order data and possibly payment details across the region. It shows hyflock's continued targeting of African retail and distribution firms, a useful indicator for sector-wide hunting.Ransomware● 46
Ransomware 'pear' publica a la aseguradora Adobe Insurance BrokersThe 'pear' group has listed Adobe Insurance Brokers LLC, an independent insurance agency in Morgan Hill, California, on its leak site. Insurance brokers hold sensitive client PII such as policy details, addresses and tax identifiers, so a full data leak exposes policyholders to identity theft and downstream fraud. Watch for reuse of agency-portal credentials and phishing of the agency's clients.Ransomware● 65
Ransomware Emperador publica a la brasileña GTL Concreto e LogísticaRansomware group Emperador listed Brazilian firm GTL Concreto e Logística, which produces concrete and runs logistics and construction operations, claiming to have stolen financial documents, personal and customer data, and employee credentials. The Latin American victim spans manufacturing, finance and transportation, so the leaked data could fuel fraud and further intrusion. Defenders should watch for credential-stuffing and invoice-fraud activity tied to this data.Ransomware● 48
Ransomware Qilin publica al distrito escolar Llano Independent (EE. UU.)The Qilin ransomware group has listed Llano Independent School District, a US education victim, on its leak site. Though outside Latin America, a freshly published ransomware victim is actionable for tracking the group's TTPs, affiliates and potential regional spillover. Education sector targeting by RaaS crews continues to rise.Ransomware● 30
Ransomware iah6477 publica a la firma estadounidense McKenneysRansomware group iah6477 lists McKenneys, a US professional-services firm, claiming 295.9 GiB of stolen data. It is a fresh victim listing but falls outside the AR-LATAM and critical-infrastructure scope, so its defender relevance is limited to supply-chain awareness. No regional impact is indicated.Ransomware● 27
Ransomware n0n publica a una empresa de salud domiciliaria de EE. UU.The n0n leak site listed a US home healthcare services provider as victim #88, currently flagged as pending exposure, meaning files may be released shortly. Home healthcare firms hold sensitive patient and billing data, but the victim is unidentified and outside Argentina/LatAm, so regional defender value is limited. Worth a low-priority watch only if the victim is later named or if a LatAm subsidiary emerges.