BRIEFRansomwarehighP50
Qilin ransomware lists Italian retailer Coop Italia
Coop Italia
Detected23 October 2026 · 07:36 UTC
The Qilin group has listed Coop Italia, one of Italy's largest retail cooperatives, on its leak site, claiming an intrusion that typically precedes data-theft extortion. Retailers hold payment, loyalty and CRM data plus supplier links, so Italian and EU partners should watch for credential reuse. The listing gives no date, proof or record count yet.
CategoryRansomware
Severityhigh
Priority score50
Detected23 October 2026 · 07:36 UTC
Ransomware● 48
Ransomware 'WallStreet' publica al proveedor médico estadounidense Prism Medical ProductsThe 'WallStreet' extortion group added Prism Medical Products, a U.S. home medical supplies provider for wound and ostomy care, to its leak site. Healthcare suppliers hold patient orders, insurance data and clinician contacts, making the exposure sensitive even though the victim is outside LatAm. It indicates active targeting of the medical supply chain that regional providers and their vendors should watch.Ransomware● 72
Ransomware 'Emperador' publica a la plataforma española B2ChatThe 'Emperador' leak site lists B2Chat, a Spain-based business messaging and customer-support platform widely used across Spanish-speaking markets, as a victim. A compromise of a multi-tenant SaaS provider could expose chat transcripts, WhatsApp/Telegram integration tokens and customer PII for many downstream organizations. Any LatAm or Spanish company using B2Chat should treat its credentials and bot tokens as potentially compromised and rotate them.Ransomware● 68
Ransomware Qilin publica a la víctima mexicana SEPIVERThe Qilin ransomware group has listed SEPIVER, a victim located in Mexico, on its leak site. Fresh publication signals an active breach with data-extortion risk for a Latin American entity. Regional defenders should investigate and warn any connected suppliers or clients.Ransomware● 44
LockBit5 publica a la minorista turca Istanbul Foodstuff TradingLockBit5 added Istanbul Foodstuff Trading Co LLC, a Turkish retail/computer-peripherals firm, to its leak site, indicating an active ransomware intrusion with likely data theft. The victim is outside the AR-LATAM region, so direct impact is limited, but it shows LockBit5's continued targeting of small and mid-size commerce. Worth noting for tracking the group's activity and TTPs.Ransomware● 42
Ransomware bravox publica al bufete estadounidense Barrow & GrimmThe bravox ransomware group listed Barrow & Grimm, a US litigation law firm, as a victim on its leak site. Law firms hold sensitive client and case data that is attractive for double extortion and downstream attacks. Monitor for related credential and data exposure affecting its clients.Ransomware● 44
Ransomware bravox publica a la francesa AMSAM (salud)The bravox ransomware group listed AMSAM, a French healthcare and social-services provider, as a victim on its leak site. Healthcare ransomware threatens patient data and service continuity, making it high-impact for the sector. It is outside Latin America but signals continued targeting of the health and social-care sector.