On 5 September an extortion crew calling itself Emperador added the judiciary of Argentina's Jujuy province to its data leak site. Six days earlier, Dire Wolf had listed the Hospital Clinico of the Universidad de Chile, the university teaching hospital in Santiago. In between, a brand new operation called Vexy claimed McDonald's Ecuador, and then claimed it a second time.
None of the three has confirmed a breach. That part is normal. What is unusual is who is doing the naming.
South American organizations took 18 leak site claims in the past seven days, from 11 different crews. That is a little above the 90-day average of about 14 a week, and 7.5 percent of the 240 claims IntelFusions logged worldwide. The volume is ordinary. The names are not. In the 12 weeks before this one, government bodies in the region were listed 10 times, and most were municipal. The largest exception was Qilin's July listing of the Argentine army. A provincial judiciary is a rarer kind of target.
A crew that collects public institutions
Emperador posted its first claim on 12 August, against the city government of Baguio in the Philippines. In the three and a half weeks since it has listed 11 organizations, and four are public bodies: Baguio, the Brazilian municipality of Arcos, Albania's national teacher training portal, and now the Jujuy courts. WatchGuard's ransomware tracker dates the group's first activity to July 2026 and classifies it as a ransomware-as-a-service operation, a builder, and a data broker.
That last label matters. One of Emperador's August posts, about a US legal technology vendor's customer database, states in the crew's own words that the same operator had published the data before under a different alias. Some of what appears on this site is recycled rather than freshly stolen.
Vexy claimed McDonald's Ecuador twice
Vexy did not exist on any tracker IntelFusions follows before 3 September. In the four days since it has posted seven listings across Ecuador, Brazil, India and Mexico, mostly small firms, plus one name anyone would recognize. McDonald's Ecuador, operated by the regional master franchisee Arcos Dorados, went up on 3 September and again on 6 September with the same domain and the same description. The crew has not said why it re-listed the company.
Vexy is one of at least six brands whose first listings IntelFusions has seen since mid-August. Za Woo opened on 30 August with 16 names, most of them German. Kazu opened on 23 August with nine listings in a single day, eight of them healthcare providers and four of those in Argentina, Brazil and Peru. Three of the newest crews have gone straight for the region's hospitals and public bodies.
Chile's teaching hospital, one day after the surge
Dire Wolf listed the Hospital Clinico Universidad de Chile on 30 August, the day after IntelFusions reported that ransomware crews had turned on Chile after months of quiet. Dire Wolf is an older operation, documented since May 2025 with 54 listings in our data and a profile built on manufacturing and technology firms. A university hospital sits well outside it. Chile's country profile tracks the rest of its listings.
The rest of the week was more familiar: six claims in Brazil, three in Argentina, two in Colombia, one each in Peru, Uruguay and Venezuela. Ecuador's two are both Vexy's McDonald's posts.
Treat a listing as a signal to verify, not a verdict
Everything on a leak site is an unverified claim written by criminals about their own work, and this week shows two ways a claim can mislead: a data broker re-selling an old dump under a new name, and a four-day-old crew re-posting the same victim. An organization that finds its domain on one of these sites should check what was actually posted, compare any sample against its own records, and involve its national CERT (CERT.ar, Chile's National CSIRT, EcuCERT) before honoring a deadline or dismissing the post.
The pattern to watch is not the count but the direction. Courts, hospitals and city governments are where a small crew can generate the most public pressure for the least effort, and the crews arriving in South America this month are small, new and looking for exactly that.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.