Frato Data Breach

Frato, a company operating in Brazil under the domain frato[.]com, was listed on the DragonForce ransomware group’s leak site on August 24, 2026. The targeting of a Brazil-based entity by DragonForce signifies the group’s increasing operational scope within Latin American markets, complementing its more frequent activity in North America and Europe. This move aligns with the ransomware group’s documented global reach and opportunistic approach to victim selection. In the 60 days preceding this listing, DragonForce claimed 48 victims. The most heavily impacted sectors for the group have been Business Services and Manufacturing, with the United States, the UK, and China representing its primary geographic focuses. Frato’s situation is consistent with the group’s broader targeting patterns, and similar victims include Wozair, QPC Global, Mike Graham Heating And Air Conditioning, and Vermont XCenter.

SOCRadar’s analysis of stealer-log telemetry for the domain frato[.]com returned no matching records within the queried dataset. It is important to note that this specific dataset represents a paginated sample and does not encompass all active log feeds, alternative corporate domains, or credentials harvested using personal email aliases. Therefore, the absence of records in this particular query does not confirm that the organization remains unaffected by credential harvesting. The modus operandi for DragonForce and associated initial access brokers (IABs) typically involves obtaining fresh credentials from underground markets, validating their corporate applicability, and subsequently using them to authenticate against services such as Microsoft 365, VPNs, or other remote-access portals. Given DragonForce’s demonstrated interest in Latin America, and the common use of hybrid infrastructure by Brazilian organizations which may include Portuguese-language portals not always captured in standard stealer-log samples, a broader scope of credential coverage is recommended. This includes monitoring any Brazil-hosted single sign-on (SSO) or remote-access endpoints to detect potential unauthorized access paths.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.