Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

BR · #8 of 183 countriesWatch Brazil

Ransomware Attacks In Brazil.

As of Oct 19, 2026, 600 organisations in Brazil have been listed as ransomware victims on leak sites, 1.9% of all confirmed victims and rank 8 of 183 countries. The most active group here is LockBit 3.0.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
600
Share of all victims
1.9%
Rank
#8 of 183
Most active group
LockBit 3.0
Most hit sector
Consulting

Victims Posted Per Month.

Confirmed ransomware victims in Brazil per month
MonthConfirmed victims
November 202512
December 202524
January 202610
February 202620
March 202618
April 202616
May 202613
June 202617
July 202621
August 202623
September 202624
October 2026 (month in progress)20

Most Active Groups Here

  1. LockBit 3.0457.5% of all victims
  2. The Gentlemen366.0% of all victims
  3. LockBit 5.0315.2% of all victims
  4. RansomHub284.7% of all victims
  5. Akira274.5% of all victims

Most Hit Industries Here

  1. Consulting579.5%
  2. Education and Research427.0%
  3. Technology396.5%
  4. Government and Public Sector376.2%
  5. Retail376.2%

Latest Victims.

All 600 victims in Brazil →
Latest confirmed ransomware leak-site victims in Brazil
VictimClaimed byCountryIndustryData claimedPosted
GTL Concreto e Logística LTDA
gtlconcreto.com.br
EmperadorBRBrazilManufacturing2 GB
Prafesta Ind. e Com. de Embalagens Ltda
prafesta.com.br
N0nBRBrazilManufacturingNot stated
Hospital Sírio-Libanês
hsl.org.br
The-seven-deadly-sinsBRBrazilHealthcare3.5 MB
MPI LTDA
mpiengenharia.com
EmperadorBRBrazilConstruction370 MB
Universidade de Passo Fundo
upf.br
The GentlemenBRBrazilEducation and ResearchNot stated
CLIMEDI
climedi.com.br
The GentlemenBRBrazilHealthcareNot stated
Pantanal Agricola
pantanalagricola.com.br
The GentlemenBRBrazilAgricultureNot stated
FINANCIAMENTO LTDA
lexcursos.com.br
INC RansomBRBrazilManufacturingNot stated

Know When A Company In Brazil, Or One Of Your Suppliers, Is Posted.

Brandefense alerts on leak-site posts for your brands and third parties, with the group's profile and IOC feeds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.