Cacspmec listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Ecuador
• Sector: Financial Services
• Announcement date: May 22, 2025

Ecuadorian financial cooperative targeted by Qilin ransomware group

The Ecuadorian savings and credit cooperative Cacspmec has been listed on the leak site of the Qilin ransomware group. According to the announcement made on May 22, 2025, the threat actors claim to have gained unauthorized access to the institution's systems on the same day the leak was announced. The group has stated that if the management of Cacspmec does not initiate contact, the data may continue to be shared on their platform.

Details of the alleged breach

The Qilin group has published data that they claim belongs to the institution Cacspmec. While the specific volume of the data and the exact number of files involved have not been disclosed by the group, the announcement describes a significant breach of sensitive information. The threat actors utilize a method known as double extortion, where they not only encrypt an organization's data to disrupt operations but also threaten to leak the stolen information publicly to pressure the victim into paying a ransom.

The announcement claims to contain a wide variety of sensitive information. The types of data allegedly involved in this incident include:

• Customer databases
• Identification details
• Addresses
• Phone numbers
• Email correspondence
• Bank details
• Credit agreements
• Employee correspondence
• Accounting documents
• Payroll data

About Cacspmec

CACSPMEC is an Ecuadorian savings and credit cooperative that was founded in 1978. The institution provides various financial services and savings solutions specifically tailored to the public employees of the Ministry of Education and Culture.

Risk assessment and implications

This incident indicates that a financial institution may face the risk of exposure regarding sensitive customer and employee data. The allegedly leaked data could potentially lead to secondary risks for the affected individuals, such as identity theft and fraud. Furthermore, there is an anticipation that the leaked data could be utilized by malicious actors for targeted phishing attacks against the individuals involved.

From an organizational standpoint, the incident suggests potential disruptions to operational continuity due to the nature of the Qilin group's tactics. Additionally, the institution may face legal sanctions under Ecuadorian data protection regulations as a result of this exposure. In the broader context of cybersecurity, such incidents highlight the ongoing challenges faced by the financial sector in protecting sensitive information from sophisticated ransomware groups.

When organizations in the financial sector face such threats, common defensive strategies often involve implementing multi-factor authentication, maintaining robust offline backups, and conducting regular security awareness training for employees to prevent initial access. However, in cases involving double extortion, the risk of data exposure remains a significant concern for both the organization and its clients.