Jampac Alimentos Data Breach

Akira ransomware has added Jampac Alimentos, a food manufacturing and distribution company operating in Latin America, to its dark web leak site on October 3, 2026. The group claims to have exfiltrated corporate data from the organization’s systems. Food and agri-food companies are prime targets for ransomware groups due to the sensitive nature of their data, which includes production recipes, supplier relationships, cold chain logistics data, and financial records. This information provides significant leverage for double extortion tactics and carries substantial consequences if published or compromised, potentially impacting the wider supply chain. Akira has demonstrated consistent activity this quarter, with listings extending across Latin America, Europe, and the Asia-Pacific region, in addition to its established presence in North America. The group’s affiliates commonly employ VPN credential exploitation and phishing campaigns for initial access, with a documented increase in the use of infostealer-sourced credentials as a vector. Pre-encryption reconnaissance is a systematic part of their operations, involving extensive data staging before the ransomware payload is deployed.

SOCRadar’s stealer-log query for Jampac Alimentos did not yield any confirmed credential exposure. However, this finding does not definitively rule out a compromise. Initial access may have been gained through alternative methods such as phishing attacks or exploitation of vulnerabilities in internet-facing ERP or logistics applications, rather than through mass-distribution stealer campaigns. It is noted that Latin American food companies often expose authentication for these platforms to the internet, making these endpoints potential targets regardless of stealer-log results. Jampac Alimentos should initiate incident response procedures to thoroughly investigate the scope of the intrusion and safeguard ongoing operations. Key protective measures include implementing multi-factor authentication on ERP and logistics platforms, establishing network segmentation between production and enterprise IT environments, and ensuring verified offline backups of critical operational data are maintained. Furthermore, communication with supply chain partners is advised to inform them and request heightened monitoring for any downstream anomalies.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.