BRIEFRansomwarehighP60
moneymessage ransomware claims U.S. Electrical Services and Wiedenbach Brown
U.S. Electrical Services / Wiedenbach Brown
Detected21 September 2026 · 15:37 UTC
The 'moneymessage' ransomware group has listed U.S. Electrical Services and Wiedenbach Brown, an electrical distribution firm in the energy and utilities sector, as a victim. Publication indicates a live or confirmed intrusion against a critical-sector supplier with exposure of operational and customer data. Energy-sector defenders should watch for related leaks and lateral activity.
CategoryRansomware
Severityhigh
Priority score60
Detected21 September 2026 · 15:37 UTC
Ransomware● 48
Ransomware Metaencryptor publica a Visual IntelligenceThe metaencryptor ransomware group has freshly published Visual Intelligence, Inc., a US managed-services and telecom-data technology firm, as a victim. A new listing signals an active intrusion with likely data theft and extortion. Though outside Latin America, its telecom-data services may carry supply-chain relevance for regional operators.Ransomware● 42
Ransomware Qilin publica a la japonesa IKEGAMI TSUSHINKIThe Qilin ransomware group published IKEGAMI TSUSHINKI, a Japanese manufacturing company, on its victim leak site, indicating a confirmed recent intrusion and data-theft extortion. Such manufacturing victims face operational disruption and exposure of proprietary and employee data. Although outside Latin America, it is a fresh ransomware victim worth tracking for sector TTPs and supply-chain relevance.Ransomware● 41
Ransomware ThreeAM publica al fabricante Newman TractorThe 'threeam' ransomware group published US heavy-equipment manufacturer Newman Tractor as a victim. Manufacturing firms are prime targets because operational downtime is costly, and extortion leaks can expose employee and customer data. It is outside LATAM but a fresh victim useful for tracking group TTPs.Ransomware● 50
Ransomware LockBit5 publica al banco etíope Siinqee BankThe LockBit5 ransomware group listed Siinqee Bank, an Ethiopian financial institution, on its leak site. A bank breach can disrupt payment and core banking services and expose customer financial data, and extortion often precedes data publication. Though outside Latin America, it is a fresh financial-sector victim worth tracking.Ransomware● 28
Ransomware Incransom publica a la ortodoncista estadounidense Maryann KrigerIncransom listed Bonita Orthodontics (Dr. Maryann Kriger), a small US practice, on its leak site. The claimed breach could expose patient records and PII, but the victim is small-scale and outside the LATAM focus. Limited regional relevance, useful mainly as context on the group's ongoing activity.Ransomware● 62
Ransomware Incransom publica a la inmobiliaria española Second HouseIncransom has listed Second House, a Barcelona-based real estate company with over 26 years in the property sector, on its extortion leak site. The group claims to have stolen corporate data, potentially including client, tenant and rental-management records. Spanish property and hospitality defenders should treat this as an active extortion campaign with data-leak risk.