Ransomware victim disclosure
← All victimsGrupo Petersen
listed as grupopetersen.com.ar · Claimed by apt73 · listed 6 hours ago
Status timeline
- Listed
May 21, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileGrupo Petersen is a multidisciplinary Argentine financial and industrial conglomerate operating across banking, construction, agribusiness, insurance, technology, and infrastructure projects. The group positions itself as contributing to Argentina's development and operates multiple subsidiary units including Banco San Juan and mining services divisions.
- Industry
- Financial Services, Banking, Construction, Agribusiness, Insurance, Technology & Infrastructure
Attack summary
Severity: high — Confirmed exfiltration of significant business data from a major financial and industrial conglomerate including financial reports and internal documents. Data has been published. Large-scale exposure (10,000 files) affecting a regulated entity (banking operations).APT73 claims to have exfiltrated approximately 10,000 internal files including financial reports and sensitive business documents from Grupo Petersen. The group has published the data and is soliciting ransom or third-party bids for the full dataset.
Data the group says was taken
AI dossier — extracted from the leak post- Internal documents
- Financial reports
- Sensitive business information
- Banking records
- Corporate data
What the group claims
Grupo Petersen is a multidisciplinary financial and industrial group from Argentina, operating in...
The leak post
captured from the group's siteDeadline: 2026/05/29 12:00:00 UTC +0 Grupo Petersen is a multidisciplinary financial and industrial group from Argentina, operating in the fields of banking, construction, agribusiness, insurance, technology and infrastructure projects. Internal documents, financial reports, sensitive information. Total number: 10,000 files. | *Until the files will be available left* | *We always initially offer to buy data by origin company. But we are also ready to consider third-party offers.* | | --- | --- | *If you see that a timer is running in your company's block, you have a chance to avoid a data leak. To do this, you need to write to us in the form and indicate your details. Our support team will contact you shortly and help you. **You must understand that there is no time to think, you must make a decision quickly, the timer has started.** If you see a button at the bottom of your company's publication, this means that all data is publicly available. If you are a customer or employee of a company that has been affected, please contact us and give us the information about yourself that you want removed. We will check what we have related to you and remove it from the leak. **T…
Sources
Source
Indexed 6 hours agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.