BDO Perú listed on incransom leak site

• Ransomware group: incransom
• Country: Peru
• Sector: Financial Services
• Announcement date: August 29, 2025

incransom claims to have stolen data from BDO Perú

The ransomware group known as incransom has published an announcement on its dedicated leak site, claiming to be in possession of sensitive data belonging to BDO Perú. According to the threat actor's post, the breach occurred around August 20, 2025, though the official announcement was made on the group's platform on August 29, 2025. The group's claim suggests a significant compromise involving both the institution and its diverse client base.

The threat actor alleges that the stolen information is quite extensive, involving the personal data of department heads and various clients. Furthermore, the group claims that the leak includes sensitive electronic signatures and critical accounting records. The scale of the alleged breach is notable, as the group asserts that the information pertains to more than 500 of the institution's partners and clients.

Details of the alleged data leak

The announcement provided by the threat actor specifies that the compromised data encompasses a wide range of sensitive materials. Based on the group's claims and the accompanying evidence, the following types of information are reportedly included in the leak:

• Personal data of department heads
• Electronic signatures
• Client data
• Accounting data
• Audit-related materials
• Identity documents

The group has provided screenshots as evidence to support their claims, which reportedly display various identity documents and samples of official records. While the group has made these claims, no specific information was provided regarding the total size of the data or the specific number of files stolen. Additionally, no ransom demand has been disclosed by the group in the provided announcement.

About BDO Perú

BDO Perú is the Peruvian member firm of the international BDO network. The organization provides a variety of professional services, including audit, tax, and advisory services. The company offers specialized expertise in financial reporting, tax planning, and business consulting to a wide array of businesses operating across various sectors.

Analysis and potential risks

The incransom group is a ransomware actor that emerged in mid-2023. This group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This tactic is designed to increase the pressure on victims to pay the ransom, as the threat of a data leak can cause significant reputational and regulatory damage.

This specific incident may pose several secondary risks. For BDO Perú employees and clients, the exposure of personal information and electronic signatures could lead to identity theft and targeted phishing attacks. Because the institution operates within the audit and financial services sector, the leaked data may carry high risks regarding trade secrets and client confidentiality. Such a breach can lead to significant compliance challenges for the institution under Peruvian data protection regulations.

Furthermore, the scope of the alleged data may result in substantial reputational damage and raise serious concerns regarding the security of the institution's supply chain. In the financial and audit sectors, maintaining the integrity of client data is paramount. Organizations in this sector typically focus on robust defensive measures, such as multi-factor authentication, regular security audits, and strict access controls, to mitigate the risks of such high-impact breaches.