BRIEFRansomwarehighP73
incransom ransomware publishes Costa Rican credit union Coopecaja
Coopecaja (Costa Rica)
Detected15 October 2026 · 22:56 UTC
The incransom ransomware group listed Coopecaja, a Costa Rican savings-and-credit cooperative (coopecaja.fi.cr), as a victim, exposing a LATAM financial-services entity. This is a fresh victim post in the banking/credit-union sector of the region, a high-value target for extortion and downstream fraud. Defenders in Costa Rican financial services should treat this as an active leak event and check for related credential or data exposure.
CategoryRansomware
Severityhigh
Priority score73
Detected15 October 2026 · 22:56 UTC
Ransomware● 42
IncRansom publica a la firma legal estadounidense Fair FeeIncRansom has published Fair Fee Legal Services, a US professional-services firm, as a ransomware victim. Although outside Latin America, such listings show an active extortion operation and may include data belonging to related clients. Regional defenders should track the group's TTPs for potential spillover.Ransomware● 50
IncRansom reclama filtracion de 2TB ligada a AT&T (Verveba)IncRansom claims a 2TB breach of Verveba, linked in the listing to www.att.com, a major US telecom. Telecom data can expose customer and network information, and the large volume suggests significant exfiltration. Regional operators should monitor the group given the critical-infrastructure sector.Ransomware● 40
Qilin publica a la británica Kemlows Diecasting ProductsQilin has published Kemlows Diecasting Products Limited, a UK manufacturing firm, as a ransomware victim. The listing indicates stolen data and potential production disruption, affecting automotive and industrial supply chains. It is a fresh victim publication relevant for third-party and supply-chain risk monitoring outside Latin America.Ransomware● 45
Qilin publica a la japonesa Keio Corporation como víctimaRansomware group Qilin has listed Keio Corporation, a Japanese transportation company, on its leak site. Transportation is critical infrastructure, and the publication signals data theft and likely operational disruption if talks fail. It matters as a fresh ransomware victim for sectoral and supply-chain awareness, even outside the region.Ransomware● 66
Ransomware Qilin publica a Telcoe Federal Credit UnionThe Qilin ransomware group has listed Telcoe Federal Credit Union, a US financial services victim, on its leak site. Fresh ransomware listings signal an active extortion operation where stolen member and financial data may be published if the ransom is not paid. Financial-sector defenders should treat this as an early warning and monitor for downstream fraud and credential abuse.Ransomware● 35
Ransomware iah6477 publica a la alimentaria Hilmar Cheese (EE.UU.)The iah6477 ransomware group has listed Hilmar Cheese, a US dairy producer, with roughly 719 GiB of claimed exfiltrated data. Food and agriculture victims raise supply-chain and operational-disruption risks. It is outside the AR-LATAM region, so it is a lower-priority item for local defenders but notable in scale.