Amzur Technologies Data Breach

The unsafe ransomware group claimed Amzur Technologies as a victim on 2026-08-30, publishing the Brazil-based technology firm on its leak site and asserting unauthorized access to company systems and data. SOCRadar’s analysis of stealer-log telemetry indicated significant credential exposure preceding the leak-site listing. The incident is currently unverified, and SOCRadar treats this as an alleged claim. Amzur Technologies operates via the domain amzur[.]com. Over the preceding 60 days, the unsafe ransomware group has listed five victims, with its targeting primarily concentrated in the United States and Brazil. The group’s sector focus encompasses Technology and Manufacturing. Amzur Technologies, a technology entity based in Brazil, aligns with the group’s established targeting patterns, making it a logical target.

SOCRadar CTI’s stealer-log analysis returned a verdict of “severe_exposure_in_sample” for Amzur Technologies. The infostealer telemetry flagged 16 employee credentials associated with NetSuite, Google Workspace, and Oracle systems, in addition to two corporate third-party credentials. The timestamps for these compromised credentials span from 2024-12-05 to 2026-08-25, suggesting a period of sustained pre-attack access for the threat actors. This credential exposure, particularly the availability of credentials for critical systems like NetSuite, Google Workspace, and Oracle, could provide a pathway for threat actors to gain unauthorized access to Amzur Technologies’s sensitive data and systems. The extended timeframe of the exposed credentials indicates potential long-term compromise. The presence of exposed credentials from various platforms highlights the importance of continuous monitoring for such exposures. Organizations should implement proactive measures such as regular credential hygiene checks, password rotations, and multi-factor authentication reviews to mitigate the risks associated with stolen credentials.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.