Automovil Supply S.A Data Breach

Automovil Supply S.A, a manufacturing company based in Paraguay, was identified as a victim of the TheGentlemen ransomware group. The listing was published on July 7, 2026, marking an expansion of the ransomware group’s activities into South America. The company operates within the automotive supply sector. SOCRadar’s threat intelligence indicates that TheGentlemen has been highly active, targeting sectors such as business services, manufacturing, and healthcare, with a primary focus on victims in the United States, Germany, and India. This incident is part of a broader trend of TheGentlemen’s operations, which has claimed numerous victims globally. The specific targeting of Automovil Supply S.A is notable as it represents an unusual geographic focus for the group.

SOCRadar’s analysis revealed a significant exposure related to the supply.com.py domain through its stealer-log telemetry. This exposure included direct credentials for the organization’s mail server, as well as numerous third-party SaaS and B2B portal logins associated with corporate email addresses. This combination suggests an active endpoint compromise and ongoing credential harvesting, indicating a high risk of corporate intrusion. The presence of mail server credentials is the most critical finding, elevating the severity of the exposure. The methodology of using stealer-log harvested credentials is a common initial access vector for ransomware groups like TheGentlemen. These credentials are often sourced from underground marketplaces and used to gain access to corporate networks, including Microsoft 365, VPNs, and remote-access portals, before deploying ransomware. While the stealer-log evidence doesn’t definitively confirm TheGentlemen’s use of these specific credentials, the pattern aligns with typical kill chains for such incidents. CTI teams are advised to treat these exposed accounts as potential access paths and prioritize credential rotation, session invalidation, and enhanced monitoring of mail server and SaaS sign-in activity.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.