BRIEFRansomwarehighP58
MedusaLocker ransomware publishes pharmaceutical firm Thermo Group
Thermo Group, C.A.
Detected11 November 2026 · 22:13 UTC
The MedusaLocker group listed THERMO GROUP, C.A., a wholesaler of pharmaceutical products and medical supplies, on its ransomware leak site, claiming a breach with stolen data. Internal financial records, sales-commission reports and tax-withholding documents appear to be in scope, making it a supply-chain concern for clinics and pharmacies that buy from it. The country is not stated, but the company naming and tax references point to Latin America.
CategoryRansomware
Severityhigh
Priority score58
Detected11 November 2026 · 22:13 UTC
RansomwarePriority 40
Ransomware Qilin publica al club de béisbol Wisconsin Timber RattlersThe Qilin ransomware group listed the Wisconsin Timber Rattlers, a US professional baseball club in the hospitality sector, on its leak site. Though a lower-value target, the listing indicates a claimed breach with possible data theft. Sports and hospitality organizations should monitor and verify.RansomwarePriority 68
Ransomware settra publica a la italiana Energreen (energía)The settra ransomware group published Italian manufacturer Energreen S.p.A., an energy and utilities sector company, on its leak site. Publication signals a claimed breach with likely data theft and operational disruption for an industrial firm. Energy-sector organizations and partners should review third-party exposure.RansomwarePriority 45
Ransomware Qilin publica a la transportista Leonard's ExpressThe Qilin ransomware group listed Leonard's Express, an Australian transportation and logistics company, on its leak site, threatening to expose stolen data. Logistics providers are critical to supply chains, so leaks can reveal operational, customer and shipment information. Although the victim is outside Latin America, it reflects Qilin's ongoing activity relevant to transport and logistics defenders regionally.RansomwarePriority 44
Ransomware Akira publica a la empresa de HVAC Quality AirAkira listed Quality Air, an HVAC services company, threatening to publish corporate data such as employee passports, driver's licenses, W-9 forms and customer contracts. Identity and financial documents raise fraud and account-takeover risk. Service-sector firms and customers should monitor for the data release and phishing.RansomwarePriority 46
Ransomware Akira publica a la manufacturera R3 CompositesAkira listed R3 Composites, a compression-molding manufacturer serving automotive and heavy-truck industries, threatening to release 8 GB that includes employee personal information. Such data supports identity fraud and downstream attacks on the manufacturer's partners. Automotive supply-chain firms should monitor the leak and review third-party exposure.RansomwarePriority 52
Ransomware Akira publica a la constructora Leware (Florida)The Akira ransomware group listed Leware Construction Company, a Florida bridge contractor, threatening to release 30 GB of corporate data including employee IDs, SSNs, contracts and client information. Exposure of personal and contractual data fuels identity theft and supply-chain targeting. US construction firms and the company's partners should treat the leak as likely and monitor for its release.