Ransomware en México

A U.S. amusement, arcade & attractions company added to the PLAY ransomware data-leak site.

A threat actor using the alias Kazu is extorting WELL Health Kensington Medical Centres (kmc.cortico.ca), a community medical clinic in Canada that provides family medicine, same-day appointments, virtual care, and specialist referrals to patients of all ages, operating as part of WELL Health Technologies on the Cortico platform.

A threat actor using the alias 0xSec has posted what they describe as the database of Flawireless, a US-based wholesaler of mobile phone accessories and refurbished electronics that also trades as Techy Extra.

A threat actor using the alias NormalLeVrai has posted a “comeback” teaser headlined as a leak of GOV.CO, the official digital platform of the Colombian government, claiming 4,300,002 records.

A threat actor using the alias Saturne has posted what they describe as the customer database of leroymerlin.es, the official Spanish e-commerce site of Leroy Merlin, a major home-improvement and DIY retail chain.

.dwi-root *, .dwi-root *::before, .dwi-root *::after { box-sizing: border-box; } .dwi-root { --bg: #0a0e16; --bg-2: #0d131f; --ink: #e8eef7; --ink-soft: #9fb0c7; --ink-dim: #5d6b82; --cyan: #34e0ff; --cyan-deep: #0bb6da; --amber: #ffb020; --red: #ff4d5e; --line: rgba(120, 160, 210, .14); --line-2: rgba(120, 160, 210, .26); --card:

A threat actor using the alias Albertcamus is advertising what they describe as a database of facial images and identity records for 347,178 Ecuadorian citizens.

CVE-2026-47729, nicknamed Squidbleed, is a heap buffer over-read in the FTP gateway of the Squid web proxy.

A threat actor using the alias shabat is advertising the sale of unauthorized access to France's SIV (Système d'Immatriculation des Véhicules), the country's official national vehicle-registration system.

A threat actor using the alias Saturne has posted what they describe as the database of FHF.fr, the official website of the Fédération Hospitalière de France (French Hospital Federation), which represents public healthcare and medico-social institutions and runs a major job board for the public health sector.

A threat actor using the alias Kazu is extorting Meducar (meducar.com), a Latin American telemedicine and patient-management platform owned by Grupo Cormos, an Argentine health-tech company.

A threat actor using the alias ChimeraZ has posted what they describe as the database of Whise.eu, a European real-estate CRM used by agencies and agents to manage leads, properties, and transactions.

A threat actor using the alias TomTom has posted what they describe as the member database of Stockaholics.net, a US-based online forum for stock-market, trading, cryptocurrency, and financial-market discussion.

A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.

Threat actors using the aliases M1sery157 and D3spair157 (operating as “Sociedad privada 157”) have posted what they describe as a database scraped from a Coahuila state government portal in Mexico.