BRIEFRansomwarehighP40
n0n ransomware hits Horn of Africa Environment Centre
Horn of Africa Regional Environment Centre and Network
Detected23 October 2026 · 09:36 UTC
The n0n group has published the Horn of Africa Regional Environment Centre and Network, leaking its full SAP Business One production database plus a verified complete backup. The dump includes over 15,000 journal transactions, 1,000 business-partner records and full financial ledgers. It is a fresh, high-impact ERP exposure for a regional NGO, relevant for partner and supply-chain risk monitoring.
CategoryRansomware
Severityhigh
Priority score40
Detected23 October 2026 · 09:36 UTC
Ransomware● 58
Ransomware FulcrumSec publica a la firma de datos EMARKETERFulcrumSec has published EMARKETER, a US market research and business intelligence firm, as a ransomware victim. Research firms hold large volumes of client and market data attractive for resale and competitive abuse. The listing is fresh and warrants validation of scope.Ransomware● 52
Ransomware Pear publica a la alimentaria Fresh FarmsThe Pear group has listed Fresh Farms, a US agriculture and food distributor, as a ransomware victim. Food supply chain targets carry operational disruption risk beyond the data theft itself. Victim details are thin but the listing is recent and should be tracked.Ransomware● 68
Ransomware Rhysida publica a la fabricante Line2Line CoatingsRhysida has listed Line2Line Coatings with nearly 800,000 files and 641 GB, including email archives, QuickBooks backups and banking statements with account numbers and card CVVs. This is a full-scale extortion leak with severe financial fraud exposure. Defenders should expect credential and banking data to surface.Ransomware● 48
Ransomware 'WallStreet' publica al proveedor médico estadounidense Prism Medical ProductsThe 'WallStreet' extortion group added Prism Medical Products, a U.S. home medical supplies provider for wound and ostomy care, to its leak site. Healthcare suppliers hold patient orders, insurance data and clinician contacts, making the exposure sensitive even though the victim is outside LatAm. It indicates active targeting of the medical supply chain that regional providers and their vendors should watch.Ransomware● 72
Ransomware 'Emperador' publica a la plataforma española B2ChatThe 'Emperador' leak site lists B2Chat, a Spain-based business messaging and customer-support platform widely used across Spanish-speaking markets, as a victim. A compromise of a multi-tenant SaaS provider could expose chat transcripts, WhatsApp/Telegram integration tokens and customer PII for many downstream organizations. Any LatAm or Spanish company using B2Chat should treat its credentials and bot tokens as potentially compromised and rotate them.Ransomware● 50
Ransomware Qilin publica a la minorista italiana Coop ItaliaThe Qilin group has listed Coop Italia, one of Italy's largest retail cooperatives, on its leak site, claiming an intrusion that typically precedes data-theft extortion. Retailers hold payment, loyalty and CRM data plus supplier links, so Italian and EU partners should watch for credential reuse. The listing gives no date, proof or record count yet.