Ransomware victim disclosure
← All victimsBeltran & García Financial Investment SLU
listed as Beltran & Garcia Financial Investment SLU · Claimed by NIGHT SPIRE · listed 18 hours ago
Status timeline
- Listed
Jun 6, 2026
Current state: Listed for ransom
At a glance
- Group
- NIGHT SPIRE
- Status
- Listed for ransom
- Country
- Spain
- Sector
- Financial Services
- Listed on leak site
- Jun 6, 2026
- Data size
- 600 GB
About the victim
AI dossier — public-source company profileBeltran & García Financial Investment SLU is a Spanish financial services firm specializing in investment management. The company maintains client portfolios, internal financial records, and business documentation typical of investment advisory operations.
- Industry
- Financial Investment Services
Attack summary
Severity: high — Confirmed exfiltration of client financial data and internal business documents from a financial services firm. While proof files are not currently accessible, the 600 GB data size and nature of exfiltrated content (client PII and financial records) represents significant regulated data exposure.NIGHT SPIRE claims to have exfiltrated internal documents and clients' data from the company, totaling approximately 600 GB. The group has listed the victim on their leak site but indicates data availability status as 'not available now'.
Data the group says was taken
AI dossier — extracted from the leak post- Internal documents
- Clients' financial data
- Business records
The leak post
captured from the group's site- Financial Documents- HR Data- Supervisor's Information Data is not available now. Data is not available now. Data is not available now. [la familia adualt day center](http://www.lafamiliaadultdaycenter.com) Data is not available now. Data is not available now. - QuickBooks Files- Scanned tax returns- Proposal, Contrats- QuickBooks automated backups - Banking & Financial Records- Personal data- Critical POS Data - Banking & Financial Data- Accounting & Tax Records - Financial & Accounting Records- Human Resources- Sales & Marketing - Sales Related Documents- Human Resources- Sensitive Employee Records- Email and SMS Data Data is not available now. - Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files - MSSQL-DB- HR Documents- Contracts Data is not available now. [Progressive Oral Surgery & Implantology](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/progressiveoralsurgery.com) - Patients Information Records- Financial Records [The Country Club of Darien](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/CCDarien.org) - Sales / agent / commercial operations- Industrial / manufacturing / tooling business dat…
Data the group says was taken
- Internal Documents
- Clients' Data
Screenshot of the leak post
Sources
Source
Indexed 18 hours agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.