BRIEFRansomwarehighP57
ScarlettGroup ransomware lists UK healthcare firm Fittleworth
Fittleworth
Detected14 November 2026 · 19:14 UTC
The ScarlettGroup ransomware crew has listed Fittleworth, a UK provider of home-delivered medical supplies and stoma/continence care, on its leak site. As a healthcare supplier handling sensitive patient logistics, disruption or data exposure can harm vulnerable patients. Defenders in healthcare supply chains should monitor for data publication and follow-on phishing.
CategoryRansomware
Severityhigh
Priority score57
Detected14 November 2026 · 19:14 UTC
RansomwarePriority 70
Ransomware Barracuda publica a la maderera española FINSAThe Barracuda ransomware group listed FINSA, a large Spanish wood-processing company, claiming theft of 800 GB of production and internal files and disruption of its virtualization infrastructure. The post states that operations were halted, indicating a high-impact intrusion against an industrial firm. Spanish organizations and FINSA's business partners should assess exposure.RansomwarePriority 58
Ransomware Endzone publica a la operadora Momentum TelecomThe Endzone group listed Momentum Telecom, a US cloud-voice and SD-WAN provider with about $221M in revenue, claiming access through a compromised Multi-Service Operator provisioning tool. Provisioning and diagnostic systems sit close to customer call flows, so exposure can enable interception and downstream compromise of business clients. Carriers and resellers that depend on these services need to check third-party access.RansomwarePriority 45
Ransomware Everest publica a la alemana Grundbaulabor TrierThe Everest ransomware group listed Grundbaulabor Trier GmbH, a German geotechnical and soil-testing laboratory, on its leak site. The victim is in the manufacturing/engineering sector in Germany, outside the LATAM region. It signals ongoing Everest activity but with limited direct regional impact.RansomwarePriority 43
Ransomware Netrunner publica una víctima en KuwaitThe ransomware group 'netrunner' listed a new victim on its leak site with country attributed to Kuwait; the sector is not specified and the company name appears redacted. Although outside the Argentina/LatAm focus and lacking detail, a freshly published victim indicates an active extortion operation that defenders tracking the group should monitor. The limited metadata makes attribution to a specific organization difficult.RansomwarePriority 72
Ransomware Interlock publica a K&A Industries, proveedor de credenciales PIV del gobierno de EE. UU.Interlock ransomware listed K&A Industries, a US firm that manages authentication lifecycles and issues PIV credentials to government agencies such as Los Alamos National Laboratory. The group claims to have stolen biometric templates, personal data and government contract data, exposing a supply-chain risk for federal identity systems. Government clients should assume credential exposure and verify the integrity of issued PIV certificates.RansomwarePriority 56
El grupo ransomware Panzer publica datos de RE/MAX AlemaniaThe Panzer group listed RE/MAX Germany on ransomware.live with 86GB of internal data, including broker and customer purchase records, invoices, passwords and Outlook archives. Exposed remax.de staff addresses raise targeted phishing and business-email-compromise risk. The victim is German, so it is sector context rather than a Latin American alert.