Underground · what matters today

Ransomware Qilin publica a la empresa surcoreana KD Corp

KD Corp

The Qilin ransomware group has listed KD Corp, a South Korean company, as a new victim on its leak site. The posting indicates an active intrusion and pressure to pay before stolen data is published. Fresh ransomware victims can also signal supply-chain exposure for partners and regional counterparts.

Ransomware Akira publica a la láctea Sun Valley Dairy

Sun Valley Dairy

Akira ransomware has published Sun Valley Dairy, a US dairy and truck-transportation company, claiming theft of employee and customer data plus internal financials. It signals a fresh intrusion with a pending data release. Logistics and food-sector partners should be alert to downstream fraud.

Ransomware iah6477 publica a la petfood Sunshine Mills

Sunshine Mills

Ransomware group iah6477 has added Sunshine Mills, a US pet-food manufacturer, to its leak site. Food-production firms are part of critical supply chains and face operational disruption from such attacks. The listing points to a confirmed compromise with likely data exfiltration.

Ransomware iah6477 publica al fabricante Middleby

Middleby Corporation

The iah6477 ransomware group has listed Middleby, a large US commercial kitchen-equipment manufacturer, as a victim. Manufacturing firms are critical to supply chains and are often targeted for downtime leverage. Suppliers and customers should monitor for leaked operational and financial data.

Ransomware 0x00 publica a la mexicana Bienestar Empresarial

bienestarempresarial.mx

The Mexican professional-services firm bienestarempresarial.mx has been listed by the 0x00 ransomware group, exposing corporate and client information. As a fresh Latin American victim publication, it indicates the company's systems and data are likely already compromised. Regional defenders should treat it as an active incident and check related exposure across Mexican service providers.

Ransomware Akira publica a un bufete de Arizona con datos de clientes

Akira ransomware has posted an Arizona law firm, threatening to release 24GB of data including client SSNs and passport scans. This is highly sensitive PII whose exposure fuels identity theft and downstream fraud. The firm and its clients face serious legal, privacy and financial risk.

Ransomware Akira publica a la británica Videk

Videk

The Akira ransomware group has listed Videk, a UK vision-based print-verification technology provider, claiming 8GB of stolen corporate data including employee, customer and financial information. The publication confirms an intrusion and signals an imminent data release. Partners and customers of the firm should assess their exposure.

Ransomware Qilin publica a la brasileña Brame Telecom

Brame Telecom

The Qilin ransomware group listed Brazilian telecom provider Brame Telecom on its leak site, a fresh victim in Latin America's critical communications sector. Telecom operators underpin regional connectivity and hold sensitive subscriber and network data. Brazilian telco defenders should treat this as active and review Qilin's common initial-access vectors (VPN and RDP).

Ransomware Vexy publica a la joyería india Enchanted Fine Jewellery

Enchanted Fine Jewellery

The Vexy ransomware group listed Enchanted Fine Jewellery, a small Indian jewelry retailer, as a victim. Exposure of a small retailer's data points to theft of customer and order information with limited systemic impact. It is outside Latin America and low-impact, so it is marginal for regional defenders.

Ransomware iah6477 publica a la inmobiliaria Camden Living

Camden Living / Camden Property Trust

Ransomware group iah6477 published Camden Living, a US multifamily real-estate operator, as a victim. The incident could expose resident, tenant and payment data and disrupt property-management services. The target is in the US/UK, so priority for LATAM defenders is low, though the actor is worth monitoring.

Ransomware iah6477 publica al minorista estadounidense Buckle

Buckle, Inc.

The ransomware group iah6477 has listed Buckle, a large US apparel and footwear retailer, as a victim. Publication of a major retailer suggests possible theft of customer and corporate data plus disruption of retail operations. It is outside Latin America, so relevance is limited, but the actor's campaign should be tracked.

Ransomware LockBit5 publica a la hotelera griega Kord Hotels

Kord Hotels

LockBit5 published Kord Hotels, a Greek hospitality group in Santorini, as a ransomware victim. Hospitality firms hold guest PII and payment data, exposing customers to fraud. Greek hotel operators should check for ransomware persistence and validate offline backups.

Ransomware LockBit5 publica a la tailandesa SKY CC

SKY CC Company Limited

LockBit5 listed SKY CC, a Thai customer-experience and contact-center company, on its leak site. Contact centers process large volumes of customer PII, so a breach risks mass data exposure. Thai service providers should isolate affected systems and rotate credentials.

Ransomware LockBit5 publica a la asesoría Poole Group

Poole Group

LockBit5 listed Poole Group, an Australian accounting and business advisory firm, on its leak site. Accounting firms hold sensitive client financial and tax data, making them prime extortion and downstream fraud targets. Australian SME advisors should warn clients and verify backup integrity and MFA coverage.

LockBit5 ataca a una administración pública francesa

French public administration (saintpierredescorps.fr)

LockBit5 published a French public administration (Saint-Pierre-des-Corps) as a victim on its leak site. Government bodies holding citizen data are high-value targets, and leaked files can enable identity theft and follow-on intrusion. Public-sector defenders in France should verify exposure and hunt for lateral movement.

Ciberataque a TFG London afecta tiendas Hobbs y Whistles

TFG London

A cyberattack on UK retailer TFG London has disrupted operations of its Hobbs and Whistles chains, reported in underground news feeds. It is a fresh victim but outside Latin America, with no confirmed ransomware publication or data leak details yet. Low priority for regional defenders; mainly useful for retail-sector attack trend tracking.

Filtración de 7,1 GB de la constructora canadiense Gorcon

Gorcon Construction Inc

ShadowByt3$ claims to have hacked Gorcon Construction Inc (Maple.ca) and stolen 7.1 GB of data. A named-victim leak of corporate files matters for the affected organization and its supply chain. It is outside our region and the date is unconfirmed.

Ransomware Orova publica a la taiwanesa Gatetech Technology

Gatetech Technology

Orova ransomware published Taiwanese metal-casting firm Gatetech Technology as a victim, signaling a claimed breach of its operational network. Manufacturing victims risk exposed design, supply-chain and client data, plus production disruption. It sits outside Latin America but is a fresh named victim worth noting.

Ransomware Orova publica a la india Amantya Technologies

Amantya Technologies

Orova ransomware listed Indian technology firm Amantya Technologies as a victim, indicating a claimed intrusion into its systems. The firm works in AI, cloud, telecom and GIS, so leaked data could expose client and project details. Out of region, but relevant as a fresh ransomware claim to track.

Ransomware Orova publica a la india Libre Wireless Technologies

Libre Wireless Technologies

Orova ransomware published Indian IoT/technology vendor Libre Wireless Technologies as a victim, signaling a claimed compromise of its corporate network. Exposed data could include customer, supplier or product information. Out of region, but a real named victim from a group actively posting claims.

Ransomware Orova publica al hotel Park Lane de Hong Kong

The Park Lane Hong Kong (Marriott)

The ransomware group Orova listed The Park Lane Hong Kong, a Marriott-affiliated hotel, as a victim, implying a claimed breach of its systems. Hospitality victims typically involve guest PII, booking and payment data. It is outside Latin America, but a named fresh corporate victim worth tracking for regional exposure.

Ransomware n0n publica a firma de arquitectura de Florida

Florida architecture & design firm (n0n victim, unnamed)

n0n ransomware listed a Florida architecture and design firm with a pending data release on 2026-10-14. Architecture firms hold sensitive client blueprints and often have access into partner networks, so leaked data can enable further intrusion. It is a fresh victim outside Latin America, ranking low for a regional alert but still a live leak.

Ransomware n0n publica a integrador de videovigilancia de California

California smart-building & surveillance integrator (n0n victim, unnamed)

n0n ransomware listed a California smart-building and surveillance integration firm, with data slated to publish on 2026-10-14. Such integrators hold network access and camera/system credentials for many client sites, so a breach can cascade to downstream customers. It is fresh but outside Latin America, worth monitoring rather than escalating now.

Incransom publica al centro médico Health Sciences Centre de Winnipeg

Health Sciences Centre (Winnipeg)

The Incransom ransomware group has listed the Health Sciences Centre in Winnipeg, one of Canada's largest medical institutions, claiming a major healthcare data breach. Healthcare ransomware victims face clinical disruption, patient-safety risk and regulatory exposure, and the leaked data fuels downstream fraud. Cross-border providers and LATAM health-sector defenders should watch for shared tactics.