Paessolucoes Data Breach

Paessolucoes, a Brazilian company specializing in IT solutions and services, was listed on the dark web leak site of the Panzer ransomware group on October 2, 2026. The group claims to have exfiltrated sensitive corporate data. For an IT solutions provider, the implications of this data exfiltration extend beyond direct data loss, as the compromise could expose client access credentials, project documentation, and source code held on behalf of customers. This sensitive information could then serve as a pathway for downstream targeting of the clients’ own IT environments. Panzer ransomware has demonstrated a consistent pattern of targeting mid-market IT services and technology companies within Latin America, particularly in Brazil. Over the past 60 days, their victimology suggests a focus on the same regional and sector-specific vulnerabilities. This aligns with their double extortion model, which involves encrypting data, exfiltrating it, and then threatening to publish it. The group’s activity indicates a strategic approach to exploiting the high-value initial access opportunities present within the IT services sector.

SOCRadar’s query of stealer-log data for Paessolucoes did not yield any confirmed credential hits. For an IT services firm, this outcome suggests that the intrusion vector might be more aligned with targeted phishing campaigns aimed at administrative or technical staff, or the exploitation of a remote monitoring and management (RMM) platform, rather than common infostealer activity. RMM platforms, in particular, can amplify the impact of a single compromise, enabling attackers to expose multiple client environments from a single privileged workstation. This makes the IT services sector an attractive target for ransomware operators seeking high-yield initial access. The absence of direct evidence in stealer logs does not rule out a compromise. The possibility remains that credentials could exist under alternate corporate domains not covered by the query, be associated with personal email aliases, or have been used and rotated before indexing by SOCRadar’s feeds. Data may also not yet have been indexed. The observed lack of stealer-log records should therefore be interpreted as a data point, not as a confirmation of an unaffected state. The nature of IT service providers means that compromised credentials or access through RMM tools could facilitate rapid lateral movement and significant downstream impact across numerous client networks. Therefore, Paessolucoes should conduct a thorough audit of all client-facing RMM sessions and remote access connections for the period leading up to the October 2 listing. This audit should focus on identifying any signs of lateral movement that may have reached client environments. Compliance with LGPD breach notification requirements to the ANPD is mandated if personal data was involved, and immediate engagement with CERT.br is also advised.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.