BRIEFRansomwarehighP46
Qilin ransomware publishes victim Incrys
Incrys
Detected15 September 2026 · 12:12 UTC
The Qilin ransomware group has published 'Incrys' as a new victim on its leak site. Publication signals an active intrusion with stolen data, threatening operational disruption and extortion. Region and sector are unclear, so the entity should be verified to assess exposure.
CategoryRansomware
Severityhigh
Priority score46
Detected15 September 2026 · 12:12 UTC
Ransomware● 42
Ransomware Qilin publica a Bravo Group (Singapur)Qilin ransomware has listed 'Bravo Group' (Singapore) as a victim, indicating a fresh intrusion with data theft and extortion. Newly published victims are time-sensitive because the operation may still be ongoing. Defenders should verify the entity and monitor for related data exposure.Ransomware● 55
Ransomware thegentlemen publica a la heladería peruana GelartiThe thegentlemen ransomware group listed Gelarti, Peru's largest gourmet ice-cream chain with 39 outlets, as a victim. Retail and franchise operators hold customer loyalty, payment and supplier data. Encryption of POS or back-office systems could interrupt sales across Peru and expose customer and franchisee information.Ransomware● 52
Ransomware thegentlemen publica a la contable brasileña MultiplaThe thegentlemen group listed Multipla Contabilidade Empresarial, a family accounting firm in Piracicaba, São Paulo state, as a victim. Accounting firms concentrate tax, payroll and financial records of many client companies, so a breach can cascade to those clients. It is a smaller but real Brazilian data-exposure and extortion risk.Ransomware● 68
Ransomware thegentlemen publica al integrador guatemalteco SomitThe thegentlemen ransomware group listed Somit, a Guatemalan IT systems integrator serving banks, universities and government clients, as a victim. A compromised integrator is a supply-chain risk: its access to client networks, telemedicine platforms and data centers could enable downstream intrusions. This makes it relevant to Latin American critical-infrastructure defenders.Ransomware● 60
Ransomware thegentlemen publica al Colegio Humboldt de São PauloThe thegentlemen group lists Colegio Humboldt, the German binational school in São Paulo with ~1,200 students, claiming 300GB of stolen data. Schools hold student, family, health and staff records plus financial data. A leak of that volume at a high-profile institution raises serious privacy, extortion and reputational risk in Brazil.Ransomware● 62
Ransomware thegentlemen publica a la librería argentina Santa FeThe thegentlemen ransomware group listed Librería Santa Fe APS S.R.L., an Argentine book retailer and B2B distributor in Buenos Aires, as a victim. Such firms hold customer, supplier and school-institution sales data plus payment records. Encryption or data theft could disrupt book distribution across Argentina and expose customer PII to extortion.