Ransomware victim disclosure
← All victimsGrupo VerdeAzul
Claimed by vect · listed 3 months ago
Status timeline
- Listed
Feb 24, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileGrupo VerdeAzul is a Panamanian investment holding company with over 35 years of operations, owning and operating real estate and hospitality assets, logistics, and agroindustrial portfolios. The group develops high-value residential and commercial real estate projects across Panama and holds a substantial portfolio of liquid and illiquid assets. It also invests capital in new ventures and manages logistics and maritime/land transport companies.
- Industry
- Real Estate & Hospitality Investment
- Address
- República de Panamá
Attack summary
Severity: high — Confirmed exfiltration and publication of 13.36 GB of sensitive financial business data including accounting systems, ledgers, payroll, and tax records, representing significant financial and operational data exposure for a multi-sector investment holding group.The ransomware group 'vect' claims to have exfiltrated 13.36 GB of data from Grupo VerdeAzul, with the data now published. The leaked data reportedly includes accounting system files (Sage/Peachtree), company financial records, accounts payable/receivable data, tax configuration files, and payroll-related information.
Data the group says was taken
AI dossier — extracted from the leak post- Accounting and bookkeeping system data (Sage/Peachtree)
- Company financial records and ledgers
- Accounts payable and receivable data
- Tax configuration and tax table files
- Payroll data
What the group claims
Status: STATUS: LEAKED | Sector: asset management | │ ├─Accounting and bookkeeping system data (Sage / Peachtree) │ ├─Company financial records and ledgers │ ├─Accounts payable and receivable data │ ├─Tax configuration and tax table files │ ├─Payro... DATA SIZE: 13.36 GB
Sources
- Victim siteGrupoverdeazul.com
Source
Indexed 3 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
