Disclosure context

About kazu

The Kazu ransomware group is a relatively new threat actor that emerged in November 2025, operating with apparent financial motivations based on their targeting patterns across multiple sectors and geographic regions. Given their recent emergence and limited public documentation, details about their country of origin and potential affiliations remain unclear, though their targeting of diverse international victims suggests either a ransomware-as-a-service model or an independent operation with broad reach capabilities. With only nine documented victims to date, specific details about Kazu's attack methodology, initial access vectors, and encryption techniques have not been extensively documented by major threat intelligence organizations, though their targeting spans healthcare, public sector, financial services, and technology organizations across the United States, Colombia, South Africa, Nigeria, and Great Britain. The group's recent emergence means there are no widely reported major campaigns or high-profile incidents documented by established security research organizations like Mandiant, CISA, or the FBI. As of the latest available intelligence, Kazu appears to remain active given their very recent first observation date, though their limited victim count and recent emergence make definitive assessments of their operational status preliminary. The group has been linked to 12 public disclosures across our corpus. First observed on a leak site on November 11, 2025; most recent post May 20, 2026. The operation is currently active.

Timeline of this disclosure

January 12, 2026MyVete listed by kazuon the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Not Found sector, which has 4,859 disclosures indexed across all operators we track. Geographically, MyVete is reported in Spain, a country with 212 ransomware disclosures in our corpus.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Ransomware victim disclosure

← All victims

MyVete

Claimed by kazu · listed 4 months ago

Age

since listed · data leaked

Status timeline

Listed
Jan 12, 2026
Data leaked

At a glance

Group: kazu
Status: Data leaked
Country: Spain
Sector: Not Found
Listed on leak site: Jan 12, 2026

About the victim

AI dossier — public-source company profile

MyVete is a cloud-based veterinary practice management software platform serving more than 2,000 veterinary businesses and pet shops. It provides tools for managing patient medical records, appointments, billing, inventory, and client communications via email, SMS, and WhatsApp. The platform is accessible from any device and targets Spanish-speaking markets, as evidenced by its Spanish-language website.

Industry: Veterinary Practice Management Software

Attack summary

Severity: high — MyVete is a SaaS platform used by over 2,000 veterinary businesses; a breach of its systems implies potential exposure of PII and medical/clinical records belonging to clients and patients across all those businesses, representing significant scale and multi-tenant data risk. Data has been published rather than merely listed.

The ransomware group Kazu claims to have compromised MyVete and has published data (disclosed status: data_published). The leak post describes the platform and its data holdings, which include patient records, appointment histories, billing information, and client data across more than 2,000 veterinary practices.

high

Data the group says was taken

AI dossier — extracted from the leak post

Patient medical records / clinical histories
Client personal information
Appointment and scheduling data
Billing and payment records
Insurance claim data
Inventory records
User account credentials
Business operational data

What the group claims

MyVete is a veterinary software designed to help animal clinics and veterinary practices manage their operations more efficiently. The platform includes features for managing patient records, appointments, billing, and inventory, all in one system. MyVete allows veterinarians to track medical histories, schedule appointments, and send reminders for vaccinations or follow-up care. The software also includes tools for managing invoicing and payments, allowing clinics to accept payments through multiple methods, including credit cards and insurance claims. With its easy-to-use interface, MyVete streamlines administrative tasks, reducing time spent on paperwork and improving patient care. By providing real-time access to patient data and operational insights, MyVete helps veterinary practices improve efficiency and deliver better care to animals.

Sources

Victim sitemyvete.com

Source

Indexed 4 months ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.