BRIEFRansomwarelowP38
Panzer ransomware publishes Pakistani NGO Rahnuma-FPAP
Rahnuma-FPAP (Family Planning Association of Pakistan)
Detected24 October 2026 · 01:14 UTC
The Panzer ransomware group listed Rahnuma-FPAP, one of Pakistan's largest reproductive-health NGOs, on its leak site. Healthcare NGOs hold sensitive patient data and typically run thin security budgets, making extortion pressure high. Relevant mainly as ransomware-trend context rather than a direct Latin American alert.
CategoryRansomware
Severitylow
Priority score38
Detected24 October 2026 · 01:14 UTC
Ransomware● 38
Ransomware Deadlock publica a la eléctrica Hensel ElektrikThe Deadlock ransomware group has listed Hensel Elektrik, the Turkish subsidiary of German electrical-equipment maker Gustav Hensel, and released a data-list file. It is a fresh named victim with exfiltration data, but outside the AR/LATAM region and of limited direct relevance. Monitor only as background on Deadlock's targeting of manufacturing.Ransomware● 42
Ransomware Rhysida pone a la venta datos del bufete Sanders Law Group (EE.UU.)Rhysida is advertising roughly 8 TB of stolen data from Sanders Law Group, a New York law firm, as a data-sale listing. The trove likely contains confidential client and litigation records that can drive fraud, extortion and follow-on attacks against the firm's clients. It is outside the AR-LATAM region, but a large named victim worth monitoring for downstream exposure.Ransomware● 58
Ransomware Qilin publica a la productora española Miljaus ProduccionesThe Qilin ransomware group added Miljaus Producciones S.L, a Spanish company, to its victim portal, signaling data theft and encryption with a leak threat. This points to a real breach of a Spanish firm in the services sector whose customer and project data may be exposed. Spanish-speaking victims matter for regional awareness and supply-chain risk tracking.Ransomware● 78
Ransomware n0n publica a una firma de redes eléctricas de EspañaRansomware group 'n0n' has listed a Spanish smart-grid engineering firm as a victim, marked 'pending exposure', meaning stolen data may be dumped imminently. Targeting the energy/smart-grid sector raises OT and critical-infrastructure risk for Spain and its electricity supply chain. Iberian and Latin American utilities should hunt for the group's TTPs and exposed credentials now.Ransomware● 50
Ransomware Aurora publica a la consultora suiza ARX GroupThe Aurora group added ARX Group SA, a Swiss engineering consultancy with federal infrastructure contracts (SBB, tunnels, transit), to its leak site. Stolen fee structures and project data could aid extortion and reveal critical-infrastructure vendors. Though outside LATAM, the infrastructure relevance makes this a notable fresh victim to track.Ransomware● 62
Ransomware LockBit5 publica a la firma española ZelsiorLockBit5 added Zelsior, a Spanish technology-driven legal debt-recovery firm, to its leak site. Such firms handle sensitive debtor and financial data, so a breach risks large-scale PII and regulatory exposure under GDPR. It is a fresh regional ransomware victim that defenders and Spanish clients should track for data-dump publication.