Global Go Data Breach

Global Go, a transportation company based in Peru, was listed as a victim on the KillSec ransomware group’s leak site on August 23, 2026. The company provides essential transportation and logistics services within the Peruvian market. Global Go’s appearance on the leak site places it among a select group of KillSec victims that are geographically dispersed, spanning North America, South America, and South Asia. This listing highlights the potential reach and operational scope of the KillSec threat actor. Over the preceding 60 days, KillSec has claimed approximately four victims, with the Transportation, Healthcare, and Other industries being their most frequently targeted sectors. The group’s activity across Peru, the United States, and India suggests a pattern of targeting opportunities across multiple continents rather than a strictly regional focus. Global Go’s profile within the transportation sector aligns with KillSec’s documented vertical targeting preferences. As a Peruvian logistics provider, it represents a geographically distinct victim within a group that has shown limited recent activity targeting Latin America. The current victim dataset does not reveal other KillSec victims with the same combination of country and industry, further emphasizing the potentially opportunistic nature of this particular listing.

An initial-access correlation against SOCRadar’s stealer-log telemetry returned no records for globalgo.com.pe within the queried data slice. It is crucial to understand that a null result does not equate to a confirmed clean posture. The sample queried was paginated, and it is possible that credentials exist under alternate corporate domains or were associated with personal email aliases, which fall outside the scope of this particular query. Furthermore, any identified credentials may have been used and subsequently rotated by the organization before the data was indexed. Infostealer-sourced credentials are a well-established and effective initial access vector for ransomware groups operating at scale. While no direct stealer-log evidence was found for this specific domain in this particular query, the absence of a finding in a paginated sample is not definitive proof of the absence of a compromise. KillSec’s known operational profile is consistent with leveraging various entry paths, including phishing campaigns, exploitation of exposed VPN appliances, and the use of recycled credentials. Affected organizations are strongly advised to conduct thorough audits of their authentication logs, enforce multi-factor authentication on all internet-exposed services, and treat the listing itself as a significant indicator that the threat actor has gathered sufficient operational intelligence about the target.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.