BRIEFRansomwarehighP78
n0n ransomware publishes Spanish smart grid engineering firm
Smart grid engineering firm (Spain)
Detected23 October 2026 · 20:15 UTC
Ransomware group 'n0n' has listed a Spanish smart-grid engineering firm as a victim, marked 'pending exposure', meaning stolen data may be dumped imminently. Targeting the energy/smart-grid sector raises OT and critical-infrastructure risk for Spain and its electricity supply chain. Iberian and Latin American utilities should hunt for the group's TTPs and exposed credentials now.
CategoryRansomware
Severityhigh
Priority score78
Detected23 October 2026 · 20:15 UTC
Ransomware● 38
Ransomware Deadlock publica a la eléctrica Hensel ElektrikThe Deadlock ransomware group has listed Hensel Elektrik, the Turkish subsidiary of German electrical-equipment maker Gustav Hensel, and released a data-list file. It is a fresh named victim with exfiltration data, but outside the AR/LATAM region and of limited direct relevance. Monitor only as background on Deadlock's targeting of manufacturing.Ransomware● 42
Ransomware Rhysida pone a la venta datos del bufete Sanders Law Group (EE.UU.)Rhysida is advertising roughly 8 TB of stolen data from Sanders Law Group, a New York law firm, as a data-sale listing. The trove likely contains confidential client and litigation records that can drive fraud, extortion and follow-on attacks against the firm's clients. It is outside the AR-LATAM region, but a large named victim worth monitoring for downstream exposure.Ransomware● 58
Ransomware Qilin publica a la productora española Miljaus ProduccionesThe Qilin ransomware group added Miljaus Producciones S.L, a Spanish company, to its victim portal, signaling data theft and encryption with a leak threat. This points to a real breach of a Spanish firm in the services sector whose customer and project data may be exposed. Spanish-speaking victims matter for regional awareness and supply-chain risk tracking.Ransomware● 50
Ransomware Aurora publica a la consultora suiza ARX GroupThe Aurora group added ARX Group SA, a Swiss engineering consultancy with federal infrastructure contracts (SBB, tunnels, transit), to its leak site. Stolen fee structures and project data could aid extortion and reveal critical-infrastructure vendors. Though outside LATAM, the infrastructure relevance makes this a notable fresh victim to track.Ransomware● 62
Ransomware LockBit5 publica a la firma española ZelsiorLockBit5 added Zelsior, a Spanish technology-driven legal debt-recovery firm, to its leak site. Such firms handle sensitive debtor and financial data, so a breach risks large-scale PII and regulatory exposure under GDPR. It is a fresh regional ransomware victim that defenders and Spanish clients should track for data-dump publication.Ransomware● 68
Qilin publica a la argentina MaxiSeguridadThe Qilin ransomware group has added MaxiSeguridad, an Argentine professional services company, to its leak site. A fresh regional victim matters because private security and services providers typically hold sensitive client data and privileged access to customer environments. Even without published file details yet, extortion of this profile often escalates into data leaks affecting third parties.