BRIEFRansomwarelowP41
ThreeAM ransomware publishes manufacturer Newman Tractor
Newman Tractor
Detected21 September 2026 · 06:37 UTC
The 'threeam' ransomware group published US heavy-equipment manufacturer Newman Tractor as a victim. Manufacturing firms are prime targets because operational downtime is costly, and extortion leaks can expose employee and customer data. It is outside LATAM but a fresh victim useful for tracking group TTPs.
CategoryRansomware
Severitylow
Priority score41
Detected21 September 2026 · 06:37 UTC
Ransomware● 50
Ransomware LockBit5 publica al banco etíope Siinqee BankThe LockBit5 ransomware group listed Siinqee Bank, an Ethiopian financial institution, on its leak site. A bank breach can disrupt payment and core banking services and expose customer financial data, and extortion often precedes data publication. Though outside Latin America, it is a fresh financial-sector victim worth tracking.Ransomware● 28
Ransomware Incransom publica a la ortodoncista estadounidense Maryann KrigerIncransom listed Bonita Orthodontics (Dr. Maryann Kriger), a small US practice, on its leak site. The claimed breach could expose patient records and PII, but the victim is small-scale and outside the LATAM focus. Limited regional relevance, useful mainly as context on the group's ongoing activity.Ransomware● 62
Ransomware Incransom publica a la inmobiliaria española Second HouseIncransom has listed Second House, a Barcelona-based real estate company with over 26 years in the property sector, on its extortion leak site. The group claims to have stolen corporate data, potentially including client, tenant and rental-management records. Spanish property and hospitality defenders should treat this as an active extortion campaign with data-leak risk.Ransomware● 76
Ransomware DragonForce publica a la aseguradora ARS RenacerThe DragonForce group has listed ARS Renacer, a Latin American health-risk administrator (ARS) licensed under SISALRIL that serves hundreds of thousands of affiliates, on its ransomware leak site. The posting implies exfiltration of member and medical data from a regulated health payer. This is a fresh regional healthcare ransomware victim; defenders should monitor for extortion escalation and abuse of exposed affiliate data.Ransomware● 70
Ransomware Emperador publica a la clínica Alabama Woman's Health CareThe Emperador ransomware group listed Alabama Woman's Health Care, a US healthcare provider, as a fresh victim, claiming theft of several thousand employee and patient documents plus a photo archive. Healthcare breaches expose highly sensitive medical and personal data and enable double-extortion. It matters as a newly published victim in a critical, regulated sector.Ransomware● 40
Ransomware auditteam publica a una empresa italianaThe auditteam ransomware group published a new Italian victim whose name is partially masked. The sector is not stated, but a fresh ransomware listing indicates a confirmed network compromise and data theft. Organizations in the affected sector across Italy/Europe should watch for extortion follow-up and reuse of stolen data.