Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

CO · #27 of 183 countriesWatch Colombia

Ransomware Attacks In Colombia.

As of Oct 19, 2026, 157 organisations in Colombia have been listed as ransomware victims on leak sites, 0.5% of all confirmed victims and rank 27 of 183 countries. The most active group here is Qilin.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
157
Share of all victims
0.5%
Rank
#27 of 183
Most active group
Qilin
Most hit sector
Consulting

Victims Posted Per Month.

Confirmed ransomware victims in Colombia per month
MonthConfirmed victims
November 20256
December 20255
January 20262
February 20265
March 20267
April 20267
May 20263
June 20267
July 20269
August 20264
September 20269
October 2026 (month in progress)3

Most Active Groups Here

  1. Qilin2113.4% of all victims
  2. The Gentlemen1610.2% of all victims
  3. LockBit 3.0106.4% of all victims
  4. Clop74.5% of all victims
  5. SafePay63.8% of all victims

Most Hit Industries Here

  1. Consulting148.9%
  2. Government and Public Sector127.6%
  3. Education and Research106.4%
  4. Retail106.4%
  5. Financial Services95.7%

Latest Victims.

All 157 victims in Colombia →
Latest confirmed ransomware leak-site victims in Colombia
VictimClaimed byCountryIndustryData claimedPosted
ACI Proyectos SAS
aciproyectos.com
QilinCOColombiaConsultingNot stated
Sociedad Portuaria Mardique S.A.
spmardique.com
NightSpireCOColombiaTransportation and LogisticsNot stated
superpack.com.co
superpack.com.co
KrybitCOColombiaTransportation and Logistics151.26 GB
coosalud.com
coosalud.com
3AMCOColombiaHealthcareNot stated
Inversiones Bolívar
inversionesbolivar.com
QilinCOColombiaFinancial ServicesNot stated
Legis
legis.com.co
RhysidaCOColombiaFinancial ServicesNot stated
UNISALLE-EDU.CO
unisalle-edu.co
ClopCOColombiaEducation and ResearchNot stated
Agrocampo
agrocampo.com.co
The GentlemenCOColombiaAgricultureNot stated

Know When A Company In Colombia, Or One Of Your Suppliers, Is Posted.

Brandefense alerts on leak-site posts for your brands and third parties, with the group's profile and IOC feeds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.