VULNpocalypse
LowBreach / campaignMonitoring

Destello ransomware group claims MAPFRE Brasil on its leak site

The destello ransomware group lists MAPFRE Brasil on its leak site; the claim is unverified, so watch for official notices from MAPFRE.

Published
Exploitation
No, not confirmed: only a leak-site claim tracked by RansomLook, with no victim confirmation or independent verification

What happened

According to the claim tracker RansomLook, the destello ransomware group posted an entry titled “MAPFRE Brasil 2026” on its leak site on 2026-11-04. The listing is the group’s claim, not proof. MAPFRE Brasil has not confirmed it in the provided sources, and no independent outlet has verified it.

RansomLook records these details from the group’s post:

  • The group labels the victim as “Insurance · BR” and describes the incident as “verified access” (RansomLook).
  • The group claims a data set of 9 GB across 735 files, with “staged 10%” (RansomLook).
  • The post lists a case status of “published” and a deadline of 2026-11-03 16:40 UTC (RansomLook).

RansomLook shows this as the group’s only post to date (RansomLook).

The following are not confirmed: whether any intrusion took place, the entry point, what data the claimed files contain, whether any customer data is involved, and whether encryption occurred.

Am I affected?

This is not confirmed. The sources do not name any affected systems, products, customers or data types. If you have a relationship with MAPFRE Brasil, no source says whether your information is involved.

What to do now

  1. Watch for official statements from MAPFRE Brasil, and do not treat the leak-site listing as confirmation.
  2. Treat unexpected emails, calls or messages that reference this incident with caution. Verify them through MAPFRE’s known official channels.
  3. Do not download or share any files the group publishes.

Sources