BRIEFRansomwarehighP62
Incransom ransomware publishes Spanish real estate firm Second House
Second House (Second House, S.L.)
Detected21 September 2026 · 01:37 UTC
Incransom has listed Second House, a Barcelona-based real estate company with over 26 years in the property sector, on its extortion leak site. The group claims to have stolen corporate data, potentially including client, tenant and rental-management records. Spanish property and hospitality defenders should treat this as an active extortion campaign with data-leak risk.
CategoryRansomware
Severityhigh
Priority score62
Detected21 September 2026 · 01:37 UTC
Ransomware● 28
Ransomware Incransom publica a la ortodoncista estadounidense Maryann KrigerIncransom listed Bonita Orthodontics (Dr. Maryann Kriger), a small US practice, on its leak site. The claimed breach could expose patient records and PII, but the victim is small-scale and outside the LATAM focus. Limited regional relevance, useful mainly as context on the group's ongoing activity.Ransomware● 76
Ransomware DragonForce publica a la aseguradora ARS RenacerThe DragonForce group has listed ARS Renacer, a Latin American health-risk administrator (ARS) licensed under SISALRIL that serves hundreds of thousands of affiliates, on its ransomware leak site. The posting implies exfiltration of member and medical data from a regulated health payer. This is a fresh regional healthcare ransomware victim; defenders should monitor for extortion escalation and abuse of exposed affiliate data.Ransomware● 70
Ransomware Emperador publica a la clínica Alabama Woman's Health CareThe Emperador ransomware group listed Alabama Woman's Health Care, a US healthcare provider, as a fresh victim, claiming theft of several thousand employee and patient documents plus a photo archive. Healthcare breaches expose highly sensitive medical and personal data and enable double-extortion. It matters as a newly published victim in a critical, regulated sector.Ransomware● 40
Ransomware auditteam publica a una empresa italianaThe auditteam ransomware group published a new Italian victim whose name is partially masked. The sector is not stated, but a fresh ransomware listing indicates a confirmed network compromise and data theft. Organizations in the affected sector across Italy/Europe should watch for extortion follow-up and reuse of stolen data.Ransomware● 45
Ransomware auditteam publica a la firma rusa de energía térmica TEK SPBThe auditteam ransomware group listed TEK SPB (tek-spb.ru), a St. Petersburg heat-engineering company, as a victim. The firm designs and maintains district heating points and metering units, i.e. critical urban infrastructure, so a breach could disrupt heating services or expose industrial data. Energy/utility defenders should treat this as a reminder of OT risk arising from IT compromise.Ransomware● 36
Ransomware Qilin publica a la empresa alemana KMLSQilin ransomware has listed KMLS, a German company, on its leak site, indicating a confirmed breach with likely data exfiltration. The group typically targets mid-market firms using double-extortion tactics. German industrial and supply-chain partners should assess their third-party exposure.