Automovil Club del Ecuador ANETA Data Breach

Barracuda listed Automovil Club del Ecuador ANETA on its dark web site on October 2, 2026. ANETA provides automotive services, driver training, and road safety programs in Ecuador. Barracuda operates by exfiltrating data and then threatening publication, a tactic known as double extortion. SOCRadar detected stealer-log hits on ANETA’s e-learning portal and organizational subdomains in late September and early October 2026, within 48 hours of the ransomware listing. The volume and timing of these hits are consistent with an active infostealer campaign, suggesting these credentials likely served as the initial access vector for the attack.

SOCRadar detected stealer-log hits on ANETA’s e-learning portal and organizational subdomains in late September and early October 2026. This activity occurred within 48 hours of Barracuda listing ANETA on its dark web leak site. The volume and timing of these hits are consistent with an active infostealer campaign and strongly suggest that compromised credentials obtained through this method likely served as the initial access vector for the ransomware attack. The presence of stealer-log hits on the e-learning portal and associated organizational subdomains indicates that user credentials may have been compromised. This compromise could potentially allow threat actors to gain unauthorized access to ANETA’s systems, leading to further network lateral movement and the eventual deployment of ransomware. While the detected logs do not confirm a full system compromise, they represent a significant risk of account takeover and potential intrusion. ANETA members are advised to reset portal passwords immediately and monitor their associated email accounts for suspicious login activity. The ANETA security team should force-rotate all portal credentials, activate multi-factor authentication on member-facing platforms, and conduct thorough endpoint detection and response (EDR) checks for infostealer indicators before considering any further escalation of security measures.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.