PI***al Data Breach

The ransomware group AuditTeam has claimed a new victim, a partially redacted financial services firm identified as “PI***al” operating in Colombia. The listing was made public on August 27, 2026, and was identified through SOCRadar’s Dark Web Monitoring services. Financial services firms are attractive targets for ransomware operations due to the sensitive nature of the data they handle, including financial records, personal identifiable information, and transaction details, which can be leveraged for extortion. The specific targeting of a Colombian entity by AuditTeam is noteworthy, as their historical activity has primarily focused on Eastern Europe and CIS regions. AuditTeam’s typical victimology includes organizations in Eastern Europe and CIS countries, making this listing in Latin America a deviation from their usual pattern. This suggests either a deliberate strategic expansion into new geographic markets or opportunistic access obtained through an initial access broker with connections in Colombia. The partial redaction of the victim’s name is a standard tactic in extortion, designed to prompt the targeted organization to identify itself and engage in negotiations to prevent full public data disclosure. This approach indicates that the ransomware group is likely in an active negotiation phase with the victim.

A query for stealer-log records associated with the partially redacted financial services firm “PI***al” could not be executed. The public listing provided by AuditTeam omits the full company name and domain, preventing direct correlation with available datasets. However, financial services organizations in Colombia are frequently observed in stealer-log feeds. This suggests a high probability of credential exposure for such entities, potentially under aliases or alternate corporate domains not immediately apparent from the partial initials provided in the leak. The inability to execute a precise stealer-log query does not rule out a compromise. Infostealer malware commonly harvests credentials from browsers and other applications, which can then be sold on underground marketplaces or used by ransomware operators to gain initial access. Given the prevalence of financial data in Colombia within stealer-log feeds, it is plausible that credentials belonging to “PI***al” or its employees exist within these datasets, possibly using personal email addresses or variations of corporate domains. Action Colombian financial firms matching the “PI***al” profile are advised to rotate credentials, review network segmentation, and monitor for AuditTeam data publication.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.