Leak Monitor
Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.
Stand 22.10.2026, 20:32
Behauptung des Angreifers, kein bestätigter Vorfall
Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.
42
293
97
75
Neueste Einträge
Filter zurücksetzenemperadorGTL Concreto e Logística LTDABR
Beschreibung der Täter
Production and preparation of ready-mixed concrete and mortars. Production of cement products for construction. Construction of buildings and other construction works. Rental of vehicles and industrial equipment without an operator. IN THE ARCHIVE FINANCIAL DOCUMENTS, PERSONAL AND CUSTOMER DATA, EMPLOYEE CREDENTIALS. [Sector: Manufacturing, Finance, Transportation]
Herkunft
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 19.10.2026 · Land laut Quelle
n0nPrafesta Ind. e Com. de Embalagens LtdaBRfinanzen
Beschreibung der Täter
packaging manufacturing (extrusion) · Brazil | Senior Sapiens ERP and Vetorh HR payroll platform; eSocial government payroll filings September and October 2026; Thousands of electronic invoices with customer and supplier data; Worker and partner CPF identification numbers; Bank integration certificates and financial records | [NOT PAID — EXPOSED]
Herkunft
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 16.10.2026 · Land aus dem Text abgeleitet
thegentlemenSuhai Segurana PessoalBR
Beschreibung der Täter
suhaiseguranca.com.br Suhai Segurança Pessoal Brazilian personal security company founded in 1992 — one of the older, established firms in its niche. Core business: bodyguard/executive protection, family and residential security, security drivers, and corporate guarding, delivered nationwide. Teams are described as vetted, licensed professionals backed by 24/7 monitoring and in-house tactical training. The firm claims ISO 9001 and Great Place to Work certification, but doesn't publish certificates — claims are self-reported. No revenue, pricing, or verified headcount is public; everything is custom-quoted per job. Critically: since Brazil's 2024 law, security work is only legal if the firm holds a current federal police permit for that specific service and state — confirm yours before hiring. Also beware the unrelated "Suhai" auto insurer sharing the name — most complaints you'll find online are about insurance, not this company.
Herkunft
- suhaiseguranca.com.br
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 16.10.2026 · Land aus der Domain abgeleitet
thegentlemenPantanal AgricolaBR
Beschreibung der Täter
pantanalagricola.com.br Pantanal Agrícola S.A. is a Brazilian agri-input distributor (crop protection, fertilizers, seeds) founded in 2001 in São Gabriel do Oeste, Mato Grosso do Sul — 19 legal units, 15-16 stores across MS/MT/GO, ~300 employees, serving 64+ municipalities and 5 million hectares of farmland. Partners include BASF, Corteva, FMC, Sumitomo, ICL, and Brevant; the business model centers on barter (inputs repaid with grain) plus agronomic advisory. The headline event: Bunge signed an MOU in Nov 2021 to acquire a minority stake, adding grain-storage and trading muscle. It finances heavily through agri-receivables certificates (8 CRA/CDCA deals since 2019, ~R$217M+, incl. R$145M in 2025 via Ecoagro and a tokenized CDCA with Banco BV). Corporate governance is professionalizing — SA fechada since 2019, board expanded with independents in 2025-26, new CFO Flávio Sales (2025); founder-CEO Jonis Assmann still leads, with second generation (Bruno Franciosi) in management.
Herkunft
- pantanalagricola.com.br
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 16.10.2026 · Land aus der Domain abgeleitet
thegentlemenCLIMEDIBRhealthcare
Beschreibung der Täter
climedi.com.br CLIMEDI private multidisciplinary medical clinic and diagnostic center in Aracaju, Sergipe, Brazil — founded 5 Oct 1977 by Dr. João Antônio Macedo Santana (endocrinologist & nuclear medicine physician, UFS professor, SUNY Upstate NY–trained). Family-run (Santana-Macedo dynasty: João, son Gustavo, daughter Sara), with 76–121 staff, 50+ physicians across 3 units. Its unique regional edge: full nuclear medicine — PET-CT, scintigraphy, and I-131 thyroid cancer therapy with 5 CNEN-compliant isolation suites — plus 20+ specialties (endocrinology, cardiology, gastro, mastology, orthopedics, ENT, neuro) and complete diagnostics (MRI, CT, mammography, endoscopy, bone densitometry, 54+ tests). Quality credentials: PNCQ "Excelente" (highest tier), SBAC, DICQ; registered in CNES, works with SUS, private insurers, and union health plans (APCEF+). Government payments total R$ 11M+ (Portal da Transparência); private revenue undisclosed (est. R$ 20–50M/yr).
Herkunft
- climedi.com.br
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 16.10.2026 · Land aus der Domain abgeleitet
thegentlemenUniversidade de Passo FundoBR
Beschreibung der Täter
upf.br Universidade de Passo Fundo private community philanthropic university in Passo Fundo, Rio Grande do Sul, Brazil — founded 1968 (Decree 62.835), run by the FUPF foundation, with 7 campuses, ~10,000 students, 486 professors (48% PhD), and 100,000+ alumni. It holds the maximum MEC institutional rating (5), ranks 6th among Brazil's best private universities and 5th in research nationally (RUF 2025), and is in the THE World 2026 ranking and top-300 globally for sustainability (GreenMetric). Flagships: Medicine (MEC concept 5, expanding from 750 to 2,000 students with R$ 60M invested), Pharmacy (MEC 5), Veterinary (Hospital Veterinário + 170-ha Cepagro), Engineering (chemical #5 nationally), and Law (70 years old). Financially healthy — R$ 60M annual surplus, independent audits published, board with civil-society oversight; ~70% of students get aid (ProUni, Bolsa Filantropia, FIES, CrediUPF). New rector for 2026–2030: Edison Alencar Casagranda (93% of votes, took office July 2026).
Herkunft
- upf.br
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 16.10.2026 · Land aus der Domain abgeleitet
the seven deadly sinsHospital Sírio-LibanêsBRhealthcare
Beschreibung der Täter
hsl.org.br Company value $750M est. Rows exfiltrated 3.5M+ Affected Appointments · telessaúde · PROADI · DATASUS · FHIR patients · SOAP notes · LGPD PHI No contact · 72h
Herkunft
- hsl.org.br
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 15.10.2026 · Land aus der Domain abgeleitet
qilinBrame TelecomBRtelekommunikation
Beschreibung der Täter
Business Services
Herkunft
- brametelecom.com
- Pfad auf der Leak-Seite: /site/blog?uuid=37defa29-f502-4356-ace7-c32811790070
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 15.10.2026 · Land laut Quelle
inc ransomFINANCIAMENTO LTDABRfinanzen
Herkunft
- Pfad auf der Leak-Seite: /blog/disclosures/6acf9f0c9cd108bf26c1cfa1
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 14.10.2026 · Land laut Quelle
emperadorMyM ODONTOCLINICA S.ABRhealthcare
Beschreibung der Täter
Сompany from Paraguay operating in the field of dentistry. Financial documents, personal and customer data. The archive contains the most important documents [Sector: Medical, Other]
Herkunft
- Gruppe bei Ransomware.live
- Gruppe bei ThreatCluster
- Gruppe bei RansomLook
- von SecBoard erfasst: 14.10.2026 · Land laut Quelle
n0nCompany #65BRkein Firmenname im Eintrag
Beschreibung der Täter
packaging manufacturing (extrusion) · Brazil
Herkunft
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 13.10.2026 · Land aus dem Text abgeleitet
hyflockCooper Tec SolutionsBR
Beschreibung der Täter
Cooper Tec Solutions is a Brazilian company that provides industrial heating and combustion system solutions all across Brazil. We got a lot of their data
Herkunft
- coopertecs.com.br
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 13.10.2026 · Land aus der Domain abgeleitet
vexyGuarufilmeBR
Beschreibung der Täter
The company has operated in the packaging sector since 2006, manufacturing PVC and polyethylene films for domestic and industrial applications.
Herkunft
- guarufilme.com.br
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 13.10.2026 · Land aus der Domain abgeleitet
n0nSantos Brasil (port operations)BRtransport
Beschreibung der Täter
Port terminal operations · Brazil | Terminal operating system database scripts and operational records | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]
Herkunft
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 12.10.2026 · Land aus dem Text abgeleitet
n0nPortonave (container terminal operations)BRtransport
Beschreibung der Täter
Port terminal operations · Brazil | Terminal operating system database material and operational EDI archives | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]
Herkunft
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 12.10.2026 · Land aus dem Text abgeleitet
n0nSuperterminais (port terminal operations)BRtransport
Beschreibung der Täter
Port terminal operations · Brazil | Operational EDI archives and interface operational records | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]
Herkunft
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 12.10.2026 · Land aus dem Text abgeleitet
n0nT2S (terminal systems operations)BRtransport
Beschreibung der Täter
Port terminal operations · Brazil | Terminal systems gap-analysis documentation and internal database material | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]
Herkunft
- t2s.com.br
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 12.10.2026 · Land aus der Domain abgeleitet
arcus mediaAETHOSBR
Herkunft
- aethosconsultoria.com.br
- Pfad auf der Leak-Seite: /?p=831
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 09.10.2026 · Land aus der Domain abgeleitet
termiteiDentalSoftBRhealthcare
Beschreibung der Täter
iDentalSoft offers a cloud-based dental practice management software that is secure, modern, and designed for efficiency. The software provides comprehensive features such as smart scheduling, advanced clinical charting, and patient communication tools, making it suitable for both single and multi-practice management.
Herkunft
- identalsoft.com
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 09.10.2026 · Land laut Quelle
eclipsedipecarr.com.brBR
Beschreibung der Täter
[AI generated] N/A I don't have reliable, verifiable information about a company operating at "dipecarr.com.br." I'm unable to confirm its business activities, industry classification, or operational details with confidence. Providing fabricated details about an unfamiliar domain could result in inaccurate threat intelligence. If you have additional context or source material about this entity, I'd be glad to help analyze it.
Herkunft
- dipecarr.com.br
- Gruppe bei Ransomware.live
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 08.10.2026 · Land aus der Domain abgeleitet
umbraSOCOCOBR
Beschreibung der Täter
[PSA] SOCOCO — A Brazilian mid-sized food company with 40 employees, blending tradition and modern marketing through WordPress-driven platforms. | Updated on 2026-10-08 | REVENUE: $12M | SIZE: 174GB
Herkunft
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 08.10.2026 · Land aus dem Text abgeleitet
eclipseDIPECARRBR
Beschreibung der Täter
Dipecarr is Brazil's top truck parts distributor, founded in 1994 by Adilson José de Almeida. With over 10,000 items ready to ship and partnerships with world-known brands, they serve 80,000 customers across seven branches in key Brazilian states. The company offers everything a truck owner needs, focusing on quality service and continuous growth.
Herkunft
- dipecarr.com.br
- Pfad auf der Leak-Seite: /place/yhygyivu46x3u7zf/
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 08.10.2026 · Land aus der Domain abgeleitet
nightspireINI FiocruzBRhealthcare
Herkunft
- ini.fiocruz.br
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 08.10.2026 · Land aus der Domain abgeleitet
dragonforcePetrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.BRenergie
Beschreibung der Täter
Petrosul is a Brazilian company established in 1994, specializing in fuel storage terminal operations since 2015. The company offers state-of-the-art infrastructure, real-time control, and efficient management to ensure quality service. Its primary clients include businesses in need of reliable fuel storage solutions. Petrosul operates terminals in Sorocaba, Paulínia, and Senador Canedo.
Herkunft
- petrosul.com.br
- Gruppe bei Ransomware.live
- Gruppe bei ThreatCluster
- Gruppe bei RansomLook
- von SecBoard erfasst: 07.10.2026 · Land aus der Domain abgeleitet
incTec ImportsBR
Beschreibung der Täter
Tec Imports group offers a complete range of logistics solutions, from coordinating shipments from the manufacturer's plant to the end customer, whether by sea, air, or road. Commercial Department - contact@dorte.com.br Importation - alexandre@dorte.com.br Export - stefani@dorte.com.br Hospitalar – Cosmético - ricardolinhares@dorte.com.br Professional Hairdressing Machines -ricardoamaral@dorte.com.br Tec Zipper - diogo@teczipper.com.br Phone/Fax: +55 11 3809-6870 Phone/Fax: 55 27 3318-0888
Herkunft
- dorte.com.br
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 07.10.2026 · Land aus der Domain abgeleitet
medusalockerMillensysBR
Beschreibung der Täter
Organization with 2 emails extracted. Domain: millensys.com
Herkunft
- millensys.com
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 06.10.2026 · Land laut Quelle
medusalockerMillensysBR
Beschreibung der Täter
Organization with 2 emails extracted. Domain: millensys.com
Herkunft
- millensys.com
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 05.10.2026 · Land laut Quelle
direwolfSoftruckBR
Beschreibung der Täter
Software
Herkunft
- softruck.com
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 06.10.2026 · Land laut Quelle
direwolfSoftruckBR
Beschreibung der Täter
Software
Herkunft
- softruck.com
- Gruppe bei Ransomware.live
- Gruppe bei RansomLook
- von SecBoard erfasst: 04.10.2026 · Land laut Quelle
panzerPaessolucoesBR
Beschreibung der Täter
paessolucoes.com.br is the website of Paes Soluções, a Brazilian IT company offering business software, hosting, cloud backup, VPS, and technical support, based in Campo Mourão, Paraná.
Herkunft
- paessolucoes.com.br
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 02.10.2026 · Land aus der Domain abgeleitet
akiraJampac AlimentosBR
Beschreibung der Täter
Jampac Alimentos is a leading producer and distributor of food products in Brazil, with over 20years of experience and a commitment to quality and efficiency. The company serves more than 6,500 clients, including restaurants, supermarkets, and industrial kitchens, delivering a wide range of products such as poultry, beef, pork, dairy, and fish.We will upload 35gb of corporate data soon. Personal information (passports, payment information and other information), financials, clients information and so on.
Herkunft
- fish.we
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 02.10.2026 · Land aus dem Text abgeleitet
booba teamFUNAP - Fundação "Prof. Dr. Manoel Pedro PimentelBR
Beschreibung der Täter
Government Relations Services Website: funap.sp.gov.br Stolen data: 26 GB.
Herkunft
- funap.sp.gov.br
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- von SecBoard erfasst: 01.10.2026 · Land aus der Domain abgeleitet
ransomhouseTercaBR
Herkunft
- terca.com.br
- Pfad auf der Leak-Seite: /r/60b37541f96de3a35d59b575ad5754ed2b71f2d2
- Gruppe bei RansomLook
- Gruppe bei Ransomware.live
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 01.10.2026 · Land aus der Domain abgeleitet
brain cipherlatitudesubro.comBR
Beschreibung der Täter
We have approximately 50 GB of data containing insurance claim files, medical data, client NDA/SA documents, W-9, ACH details and amounts, SOC reports, KPI, dashboards, budgets, an...
Herkunft
- latitudesubro.com
- Pfad auf der Leak-Seite: /n/latitudesubro
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 29.09.2026 · Land laut Quelle
m3rxsomasolucoes.comBR
Beschreibung der Täter
+55 1935472050 , Soma Soluções em T.I. specializes in corporate IT solutions, offering a flexible and cost-effective ERP system tailored to the unique needs of businesses. Their services include web development, mobile applications, technical support, and digital marketing, aimed at simplifying business management and reducing operational costs. The company also provides a virtual store for IT and telecommunications equipment, enhancing brand visibility online. Their target clients are businesses seeking to optimize their operations and improve efficiency through innovative technology solutions. Stolen: --
Herkunft
- somasolucoes.com
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 29.09.2026 · Land laut Quelle
lockbit5camorim.com.brBR
Beschreibung der Täter
Camorim Serviços Marítimos has over 30 years of expertise in the maritime sector, providing a range...
Herkunft
- camorim.com.br
- Pfad auf der Leak-Seite: /post/30c6cb9f5d80f0e5bdc2a414552bea98
- Gruppe bei RansomLook
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 28.09.2026 · Land aus der Domain abgeleitet
emperadorAmazon InformaticaBRbehoerden
Beschreibung der Täter
Amazon Informática LTDA is a prominent Information Technology (IT) solutions integrator and managed services provider founded in Brazil in 1995. Amazon Informática's primary market focus is the public sector and government agencies, serving various state and federal entities in Brazil.To support these operations, they maintain strategic corporate offices in Brasília/DF (to service the federal government cluster) and Belém/PA. Furthermore, the company has expanded its footprint internationally with operational branches in Latin America and Europe (Portugal), where they deliver customized government tech solutions and enterprise infrastructure support to large private corporations in those regions. Full commitment of the network having full access to infrastructure, thus ensuring full access to the databases containing confidential and financial information! Virtual Infrastructure and Database Cluster with active administrative master credentials exposed in text clear inside get_bk.bat. Hosts compromised. The targets contain production and integration databases with sensitive PII schemas, employee registries, banking credentials, CPF, and RG data. TOX ID: 3D6EF83C3C4517FE42B212A9
Herkunft
- amazoninformatica.com.br
- Pfad auf der Leak-Seite: /post/amazon-informatica/
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- von SecBoard erfasst: 28.09.2026 · Land aus der Domain abgeleitet
arcus mediaPantaneiro CapasBR
Herkunft
- pantaneirocapas.com.br
- Pfad auf der Leak-Seite: /?p=822
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 27.09.2026 · Land aus der Domain abgeleitet
inc ransomGrupo CaberjBR
Herkunft
- Pfad auf der Leak-Seite: /blog/disclosures/6ab5075e9cd108bf266ebbdf
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 24.09.2026 · Land laut Quelle
lockbit5anery.com.brBR
Beschreibung der Täter
Somos a Anery Home Care Temos paixão por cuidar Nossa especialidade é cuidar de pessoas, com todo o...
Herkunft
- anery.com.br
- Pfad auf der Leak-Seite: /post/d2ecb5a0516faf84bfe47e60d1d3ed52
- Gruppe bei RansomLook
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 23.09.2026 · Land aus der Domain abgeleitet
emperadorRECEITA FEDERAL DO BRASILBR
Beschreibung der Täter
MINISTÉRIO DA FAZENDA SECRETARIA DA RECEITA FEDERAL DO BRASIL The archives contain several thousand documents with personnel and customer data, as well as all user date on gov.br with passwords. Publication scheduled: 2026-10-13 07:57:23 UTC Size: 6.3 GB Sectors: Finance
Herkunft
- servicos.receitafederal.gov.br
- Pfad auf der Leak-Seite: /post/receita-federal-do-brasil/
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 23.09.2026 · Land aus der Domain abgeleitet
panzerK3G Solutions BrazilBRtelekommunikation
Beschreibung der Täter
K3G Solutions is a Brazilian telecom/IT consulting company based in Manaus, providing network engineering, ISP support, monitoring, call-center, CDN, and colocation services.
Herkunft
- Gruppe bei RansomLook
- von SecBoard erfasst: 21.09.2026 · Land aus dem Text abgeleitet
arcus mediaAKAZZOBR
Herkunft
- akazzo.com.br
- Pfad auf der Leak-Seite: /?p=812
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 19.09.2026 · Land aus der Domain abgeleitet
emperadorCassias MG GovernmentBRbehoerden
Beschreibung der Täter
network commitment, from government credentials to justice panels, such as access to the financial sector, police, personal data, medical (SUS), RG(CIN), BIRTH CERTIFICATE, CPF (identity number in Brazil) among other data from CASSIAS.MG.GOV departments, we will give you a deadline to negotiate with us! Publication scheduled: 2026-09-29 07:21:56 UTC Size: 720.0 MB Sectors: Medical, Government, Finance
Herkunft
- cassia.mg.gov.br
- Pfad auf der Leak-Seite: /post/cassias-mg-government/
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 19.09.2026 · Land aus der Domain abgeleitet
n0nKonnatus (usucapião legal services)BR
Beschreibung der Täter
Legal services / real estate · Brazil What will be published if no settlement is reached The application database: chart of accounts, income/outflow structures, account types User accounts with password hashes Publication proceeds after the deadline.
Herkunft
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 18.09.2026 · Land aus dem Text abgeleitet
the gentlemenMultipla Contabilidade EmpresarialBR
Beschreibung der Täter
contabilmultipla.com.br Multipla Contabilidade Empresarial family accounting firm from Piracicaba, São Paulo state, operating since 1990 — legal entity MULTIPLA CONTABILIDADE EMPRESARIAL S/S LTDA (CNPJ 05.145.683/0001-99, founded 01/07/2002, capital R$700,000, Simples taxpayer), owned and run by husband-and-wife team Renata Nunes Albino Semmler (accounting director, 35+ years in the profession) and Charles Semmler, with the second generation (Beatriz & Eduardo Albino Semmler) joining family firms in 2026. Services: industry-specialized accounting (services, commerce, industry, healthcare, construction, agribusiness), BPO financial outsourcing (spun into Multipla Gestão Financeira, 2022), company formation & legalization, tax planning & revision, and full payroll/HR (eSocial, DCTFWeb). Team of ~15–20
Herkunft
- contabilmultipla.com.br
- Gruppe bei RansomLook
- von SecBoard erfasst: 14.09.2026 · Land aus der Domain abgeleitet
the gentlemenHumboldtBR
Beschreibung der Täter
humboldt.com.br zoominfo.com/c/humboldt/372537346 Colegio Humboldt 300gb DATA Germany's official school in São Paulo — founded in 1916 by German immigrants (first class: 41 students, May 1, 1916), now a non-profit bilingual school of ~1,200–1,300 students (ages 2–18, ~295 staff) on a 60,000 m² Interlagos campus built with German government funding (opened 1999), maintained by the parents' association SEBRB. Its dramatic history: closed twice by world wars — 1917 (WWI) and 1942 (WWII, when all assets were confiscated and took a 10-year legal battle to recover) — before parents rebuilt it into a top institution. Programs: two tracks (Bilingual — 40% German; International German — 80% German leading to the Abitur, with 100% pass rate and direct entry to German/European universities), plus DSD I/II, Cambridge, DELE certifications, and its crown jewel — the largest German dual vocational training center outside Germany (since 1982: 2-year technical programs in Administration, Logistics, IT.
Herkunft
- humboldt.com.br
- Gruppe bei RansomLook
- von SecBoard erfasst: 14.09.2026 · Land aus der Domain abgeleitet
qilinAlicotransBRtransport
Beschreibung der Täter
Freight & Logistics Services
Herkunft
- alicotrans.com
- Pfad auf der Leak-Seite: /site/blog?uuid=3c7074c9-ccce-42c3-99a3-8bd348be3be2
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 14.09.2026 · Land laut Quelle
lockbit5amorsaude.com.brBR
Beschreibung der Täter
AmorSaúde is a rapidly growing network of popular clinics in Brazil that offers medical, dental, and...
Herkunft
- amorsaude.com.br
- Pfad auf der Leak-Seite: /post/c582d78870d0815a9f37d2ee92981af3
- Gruppe bei RansomLook
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 10.09.2026 · Land aus der Domain abgeleitet
vexyLogar Network SolutionsBR
Beschreibung der Täter
Logar Network Solutions is a Brazilian managed IT services provider (MSP) that delivers outsourced IT management, cybersecurity, cloud infrastructure, backup and disaster recovery, software licensing, hardware lifecycle management, and custom software development. The company primarily serves medium-sized businesses across multiple industries, offering 24/7 IT monitoring and support. It has served more than 500 companies and operates across six Brazilian states.
Herkunft
- Gruppe bei RansomLook
- von SecBoard erfasst: 09.09.2026 · Land aus dem Text abgeleitet
dark projectAlurwallsBRfinanzen
Beschreibung der Täter
Alurwalls was attacked, resulting in the theft of approximately 17 GB of confidential data. The stolen information includes banking and other financial documents, client building plans, and other personal data belonging to the company and its partners. Currently, more than 16,000 files are no longer protected by Alurwalls.
Herkunft
- alurwalls.com
- Pfad auf der Leak-Seite: /article?slug=alurwalls
- Gruppe bei RansomLook
- Gruppe bei ThreatCluster
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 07.09.2026 · Land laut Quelle
the gentlemenBiotipo JeansBR
Beschreibung der Täter
biotipo.com.br zoominfo.com/c/biotipo-jeans/431018059 Biotipo Brazil's largest ready-stock ("pronta-entrega") jeans manufacturers — an Akkari-family company (Confecções Alta Moda Ltda, CNPJ 04.273.385/0001-11) founded in 2001, with the brand active in jeanswear since 1980, HQ'd in the legendary Brás wholesale district of São Paulo plus an industrial plant in Itapevi. Its model: B2B wholesale at fashion-week speed — weekly collections, minimum orders of just one "grade" (10–12 pieces), 15,000+ m² of production/logistics space (70% outsourced), and distribution to 15,000+ retail points across Brazil (women's, men's, teen and plus-size lines). 10+ consecutive years in Top of Mind as one of Brazil's most-remembered jeans brands; R$30M+ share capital, 1,001–5,000 employees by registry classification. Bottom line: the quiet volume king of Brazilian denim — no D2C glamour, just industrial speed, perfect fit and a brand that "sells itself" in more stores than almost any local competitor.
Herkunft
- biotipo.com.br
- Gruppe bei RansomLook
- von SecBoard erfasst: 07.09.2026 · Land aus der Domain abgeleitet
the gentlemenMutantBR
Beschreibung der Täter
mutant.com.br zoominfo.com/c/mutant/452328184 Mutant is one of Latin America's largest CX & AI companies, founded in 2016 as a spin-off from Genesys Brazil, HQ'd in São Paulo with 4,000+ employees across 14 countries. Backed by Permira, GIC and TCV, its holding "Clash" raised $75M from BlackRock in 2025 for M&A and AI. It runs 3.5 billion AI-driven interactions per year for 100+ enterprise clients — including the world's largest corporate WhatsApp operation (Caixa) — with clients like Itaú, Vivo, Santander, Claro and iFood. Built through 8+ acquisitions (Interaxa, GRB, Intervalor...), it projects ~R$1B revenue in 2026 and pours R$100M+/year into its proprietary generative AI ecosystem (IAM/Xavier/PALI). Bottom line: the quiet AI-giant of Brazilian customer experience — "Artificial Intelligence, Human Experiences" — now repositioning as the enterprise AI-intelligence layer of LatAm.
Herkunft
- mutant.com.br
- Gruppe bei RansomLook
- von SecBoard erfasst: 07.09.2026 · Land aus der Domain abgeleitet
kazuBrazil Mobilemed: Cloud PACS PlatformBRhealthcare
Beschreibung der Täter
Mobilemed is a Brazil-based health technology company that provides a cloud-based PACS (Picture Archiving and Communication System) for radiologists, hospitals, and diagnostic imaging centers. Its platform enables healthcare professionals to securely store, access, manage, and share medical images and diagnostic reports from anywhere, supporting teleradiology and improving workflow efficiency. Price: $50 000 | Size: 23.5 TB | Records: 52 243 863 files | Dump date: 2026
Herkunft
- Gruppe bei RansomLook
- von SecBoard erfasst: 07.09.2026 · Land aus dem Text abgeleitet
the gentlemenLider AviacaoBR
Beschreibung der Täter
lideraviacao.com.br zoominfo.com/c/líder-aviação/372493800 Líder Aviação is Latin America's largest business aviation company, founded in 1958 in Belo Horizonte, Brazil, as an air taxi with a single Cessna 170. Today: ~R$1.2B revenue, 1,300+ staff, 50+ aircraft, 22 own bases; 42.5% owned by US Bristow Group, run by the founder's third generation (President: Junia Hermont). A one-stop shop: charters (first booking app in Brazil), the region's largest FBO network, aircraft sales (exclusive HondaJet dealer, 1,000+ sold), a top MRO (authorized for Bell, HondaJet, Gulfstream) and offshore helicopter ops for Petrobras since 1973 (1M+ flight hours). Key edge: safety — the only Brazilian company with IS-BAO Stage 3, plus Argus Platinum and 5× Petrobras Peotram wins. First SAF flight in Brazilian business aviation (2024), now expanding into agribusiness and electric aviation. Bottom line: a 67-year-old family giant controlling South American business aviation end-to-end.
Herkunft
- lideraviacao.com.br
- Gruppe bei RansomLook
- von SecBoard erfasst: 06.09.2026 · Land aus der Domain abgeleitet
vexyEngefitasBR
Beschreibung der Täter
Engefitas is a Brazilian company that produces various adhesive tapes and adhesives for industries like packaging, automotive, construction, electronic, and manufacturing sectors.
Herkunft
- Gruppe bei RansomLook
- von SecBoard erfasst: 06.09.2026 · Land aus dem Text abgeleitet
zawoofrm.ind.brBR
Beschreibung der Täter
country: Brazil | fileSize: 41747673590 | PUBLISHED | FRM - Fábrica de Rolamentos e Mancais Ltda is a Brazilian industrial manufacturer specializing in bearings, bearing housings, and industrial movement solutions. The company is based in Curitiba, Paraná, Brazil and has been operating since 1980.
Herkunft
- frm.ind.br
- Pfad auf der Leak-Seite: index.html?indexId=cnjsdkacnoiop
- Gruppe bei RansomLook
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 06.09.2026 · Land von den Tätern angegeben
krybitwww.neooftalmo.com.brBR
Beschreibung der Täter
NEO — Núcleo de Excelência em Oftalmologia Ltda is a leading Brazilian ophthalmology hospital founded on May 13, 200...
Herkunft
- www.neooftalmo.com.br
- Pfad auf der Leak-Seite: /blog/4b72823357eb26a73b059f6030eb9aeffe8ab73756f1e4ea50e2581ace156f49/
- Gruppe bei RansomLook
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 06.09.2026 · Land aus der Domain abgeleitet
lockbit5icnavais.comBR
Beschreibung der Täter
The Itaguaí Construções Navais S.A. known as ICN, is a Brazilian state-owned defence company special...
Herkunft
- icnavais.com
- Pfad auf der Leak-Seite: /post/e994f54274410052c992e9eef9bbd031
- Gruppe bei RansomLook
- Screenshot der Veröffentlichung
- von SecBoard erfasst: 06.09.2026 · Land aus dem Text abgeleitet
barracudaVR AdvogadosBR
Beschreibung der Täter
[upcoming] VR Advogados, a Brazilian law firm, neglected its clients’ personal data, violating laws regarding data storage and confidentiality—they posted and shared all of their clients’ documents, passport information, and powers of attorney via a Discord server. We hacked it. Now we have 3,000 documents belonging to all of their clients—passports, powers of attorney, declarations, personal and work-related correspondence, and more. The firm hasn’t responded to us for three days; if this continues, we’ll start selling the data.
Herkunft
- Gruppe bei RansomLook
- von SecBoard erfasst: 06.09.2026 · Land aus dem Text abgeleitet
the gentlemenMegalaser Industria Metalurgica LTDABRenergie
Beschreibung der Täter
megalaser.com.br zoominfo.com/c/megalaser-industria-metalúrgica-ltda/1315472404 Megalaser is a Brazilian metallurgical company based in São Paulo, specializing in advanced metalworking services like laser cutting, CNC bending, and robotic welding. Founded in 2006, the manufacturer provides high-quality machined components and assemblies for diverse industries, including renewable energy, mining, automotive, and oil and gas. Their platform highlights a strong commitment to precision engineering, integrated manufacturing solutions, and sustainable industrial practices.
Herkunft
- megalaser.com.br
- Gruppe bei RansomLook
- von SecBoard erfasst: 06.09.2026 · Land aus der Domain abgeleitet
the gentlemenVector Two TechnologyBR
Beschreibung der Täter
vtt.com.br zoominfo.com/c/vtt/372441609 VTT is a pioneering Brazilian technology company founded in 1996 that specializes in Digital Signage and Retail Media solutions. As a leading provider in Latin America, the company delivers innovative digital displays, menu boards, and interactive customer experience tools for the retail sector. Their platform also supports a robust channel partner program, helping businesses across the region modernize their visual communication and in-store marketing strategies.
Herkunft
- vtt.com.br
- Gruppe bei RansomLook
- von SecBoard erfasst: 06.09.2026 · Land aus der Domain abgeleitet
Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.
Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.