Corporación Primax S.A. Data Breach

Corporación Primax S.A., an organization based in Peru, has been listed as a victim on the Aurora threat group’s dark web portal, published on June 23, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. While the specific sector was not captured in the listing metadata, Aurora has shown a targeting pattern across the Business Services, Manufacturing, and Transportation/Logistics sectors, with victims concentrated in the United States, Canada, and Peru. The presence of at least one other Peruvian victim suggests this is not an isolated incident.

Initial access correlation with SOCRadar’s stealer-log telemetry returned no records for Corporación Primax S.A.’s domain. However, this does not rule out infostealer-harvested credentials as an initial access vector, as credentials may exist in other feeds, have been used and rotated before indexing, or been harvested under personal email aliases. For ransomware groups like Aurora, infostealer-harvested credentials are a common method for gaining initial access through compromised corporate logins. CTI teams are advised to continue monitoring and implement proactive credential hygiene checks.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.