Servifruit Data Breach

Servifruit, a produce distribution company based in Mexico, was identified as a victim of the MedusaLocker ransomware group on August 27, 2026. This listing was detected by SOCRadar’s Dark Web Monitoring service. The company’s inclusion in MedusaLocker’s victim list suggests potential vulnerabilities that made it an attractive target for ransomware operations. MedusaLocker has been actively targeting entities within the healthcare, manufacturing, and food sectors. Recent claims within a 60-day period include NSW Health (Australia), Qualisteel (manufacturing), and Hungry Lion (fast food, sub-Saharan Africa). Servifruit represents the only Latin American agricultural entity among these recent claims, highlighting the group’s broad and geographically diverse targeting strategy that does not appear to follow a strict pattern.

A query of stealer-log data associated with the Servifruit domain did not yield any results within the analyzed sample. It is important to note that this query is paginated and represents only a subset of the available data. Therefore, the absence of findings does not definitively rule out the presence of compromised credentials. Such credentials might exist under an alternate corporate domain or be associated with personal email aliases not included in this specific search. Consequently, this result should be interpreted as a lack of positive indicators, not as confirmation of no compromise. The potential existence of credentials on the dark web, even if not directly linked to Servifruit’s primary domain in this instance, can significantly facilitate ransomware operations. Infostealer malware often harvests credentials from infected systems, which can then be sold or utilized by threat actors for initial access into corporate networks. While no direct compromise was confirmed by this specific stealer-log query, the possibility of compromised credentials existing under alternative domains or aliases remains, necessitating continued vigilance. Further monitoring for Servifruit on dark web forums and stealer-log feeds is recommended. Additionally, proactive credential hygiene checks, including password rotation and multi-factor authentication reviews, are advisable. Organizations should also maintain awareness of activity related to Microsoft 365, VPNs, and remote-access portals, as these are common entry points for ransomware attacks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.