Ransomware victim disclosure

Fico Ferragens Indústria e Comércio Ltda

Claimed by NIGHT SPIRE · listed 18 hours ago

600 GB

Data size

Today

Age

since listed · listed for ransom

Status timeline

Listed
Jun 6, 2026

Current state: Listed for ransom

At a glance

Group: NIGHT SPIRE
Status: Listed for ransom
Country: Brazil
Sector: Manufacturing/Hardware
Listed on leak site: Jun 6, 2026
Data size: 600 GB

About the victim

AI dossier — public-source company profile

Fico Ferragens is a Brazilian manufacturer and distributor of hardware, tools, and home organization products. They produce items including garden sprayers, irrigation equipment, connectors, faucets, hoses, garden tools, and shelving/storage systems for both residential and commercial use.

Industry: Hardware & Tools Manufacturing

Attack summary

Severity: high — Confirmed exfiltration of 600 GB including financial records, banking data, HR/employee PII at scale, tax returns, and business operations data. No proof files advertised, but data volume and sensitive nature of exfiltrated categories indicate significant breach.

NIGHT SPIRE claims to have exfiltrated approximately 600 GB of data from Fico Ferragens. The group lists financial documents, HR records, QuickBooks files, tax returns, contracts, banking records, employee data, and technical/business strategy documents as compromised.

high

Data the group says was taken

AI dossier — extracted from the leak post

Financial documents
HR and employee data
QuickBooks files and automated backups
Tax returns and scanned documents
Banking and financial records
Sales and marketing documents
Employee email and SMS data
Contracts and proposals
Technical documents
Business strategy files
MSSQL database

The leak post

captured from the group's site

- Financial Documents- HR Data- Supervisor's Information
Data is not available now.
Data is not available now.
Data is not available now.
[la familia adualt day center](http://www.lafamiliaadultdaycenter.com)
Data is not available now.
Data is not available now.
- QuickBooks Files- Scanned tax returns- Proposal, Contrats- QuickBooks automated backups
- Banking & Financial Records- Personal data- Critical POS Data
- Banking & Financial Data- Accounting & Tax Records
- Financial & Accounting Records- Human Resources- Sales & Marketing
- Sales Related Documents- Human Resources- Sensitive Employee Records- Email and SMS Data
Data is not available now.
- Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files
- MSSQL-DB- HR Documents- Contracts
Data is not available now.
[Progressive Oral Surgery & Implantology](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/progressiveoralsurgery.com)
- Patients Information Records- Financial Records
[The Country Club of Darien](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/CCDarien.org)
- Sales / agent / commercial operations- Industrial / manufacturing / tooling business dat…

Screenshot of the leak post

Leak screenshot for Fico Ferragens Indústria e Comércio Ltda

Sources

Source

Indexed 18 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About NIGHT SPIRE

NIGHT SPIRE is a ransomware group first observed in June 2026 with an apparent primary motivation of financial gain, having claimed at least 14 known victims across multiple continents within a relatively short operational window. Given the group's recent emergence and limited public documentation by major threat intelligence organizations such as CISA, FBI, or Mandiant at this time, a comprehensive technical profile cannot be fully established from open sources. Their targeting pattern, based on available victim data, reflects a geographically diverse focus spanning the United States, Singapore, Brazil, Panama, and Spain, suggesting either an opportunistic targeting approach or a deliberate strategy to operate across jurisdictions that complicate law enforcement coordination. The sectors most frequently impacted include Healthcare, Recruitment and Staffing, Hospitality and Recreation, Commerce and Trade, and Automotive, indicating the group likely targets organizations perceived as having lower cybersecurity maturity or higher operational pressure to restore services quickly, both of which increase ransom payment likelihood. No confirmed affiliations to known ransomware-as-a-service ecosystems, nation-state actors, or predecessor groups have been publicly documented as of this writing. NIGHT SPIRE's operational status as of mid-2026 reflects an active and emerging threat actor, and the breadth of their targeting across critical and commercially sensitive sectors warrants continued monitoring by defenders, particularly those operating in the identified high-risk verticals and geographies. The group has been linked to 14 public disclosures across our corpus. First observed on a leak site on June 6, 2026. The operation is currently active.

Also tracked as: nightspire.

Timeline of this disclosure

June 6, 2026Fico Ferragens Indústria e Comércio Ltda listed by NIGHT SPIREon the group's public leak site

Data size: 600 GB