BRIEFRansomwarehighP60
Qilin ransomware publishes Spanish company Geieg
Geieg
Detected15 September 2026 · 06:12 UTC
The Qilin ransomware group listed Geieg, a Spanish organisation, as a victim on its leak site. Publication signals a confirmed intrusion with data-theft extortion, exposing employee and client data. Spanish-speaking defenders should treat this as an active ransomware case in their region.
CategoryRansomware
Severityhigh
Priority score60
Detected15 September 2026 · 06:12 UTC
Ransomware● 52
Ransomware Shadowbyt3 publica a HandyTrac (Greystar, Arizona)Shadowbyt3 listed HandyTrac, a tenant key-control and access-management provider used by Greystar's Litchfield Park property. Leaked data includes physical-to-digital key maps, employee identity and credential data, and financial/vendor records. Exposed key-control reports and staff credentials can enable physical intrusion and account abuse at managed sites, making this a fresh and actionable victim even though it is US-based.Ransomware● 45
Ransomware Anubis publica a la firma contable Better AccountingThe Anubis ransomware group listed Better Accounting Solutions, a professional-services accounting firm, on its leak site, referencing Wall Street accountants' data. Data stolen from an accounting firm can include financial records and client information valuable for fraud and follow-on attacks. It is a fresh victim listing, though a small target outside the region.Ransomware● 45
Ransomware Eclipse publica al distrito escolar Dublin City SchoolsThe Eclipse ransomware group has listed Dublin City Schools, a Georgia (US) school district, on its leak site as a fresh victim. Education victims typically face operational downtime plus exposure of student and staff data, but this instance is outside Latin America, so it mainly serves to track the group's targeting.Ransomware● 45
Ransomware Eclipse publica al mayorista francés Rosello et FilsThe Eclipse ransomware group published Rosello & Fils, a French fruit and vegetable wholesaler in the agriculture and food sector, on its leak site. As a freshly-listed victim outside LATAM it is mainly context for regional defenders but confirms the group's ongoing activity. No compromise details pointing to the region are indicated.Ransomware● 35
LockBit5 publica a la firma finlandesa HTT OyLockBit5 has listed Finnish accounting firm HTT Oy as a ransomware victim on its leak site. Accounting firms hold sensitive financial records of many client companies, making them attractive extortion targets. A breach here can cascade into data-exposure and fraud risks across the firm's entire client base.Ransomware● 40
LockBit5 publica a la empresa taiwanesa tpi.twLockBit5 has listed the Taiwanese technology company tpi.tw as a ransomware victim on its leak site. The intrusion targets a tech firm, and stolen data may be published if no ransom is paid. Even a smaller victim can expose supply-chain partners and customers to follow-on phishing and fraud.