Columbia TI listed on bert ransomware leak site

• Ransomware group: bert
• Country: Colombia
• Sector: Technology
• Announcement date: June 5, 2025

A new target in the technology sector

The ransomware group known as bert has officially listed the Brazilian technology company Columbia TI on its leak site. The announcement, which appeared on June 5, 2025, indicates a significant breach involving the organization. According to the group's claims, they have successfully obtained data belonging to the company, marking a new incident in the ongoing landscape of cyber extortion.

In modern cyberattack scenarios, ransomware groups often employ a tactic known as double extortion. In this method, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this stolen information on a public or semi-public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific details regarding the ransom demand and the total volume of data stolen remain unknown, the presence of the organization on the leak site confirms the group's intent to publicize the breach.

Details of the claimed breach

The group bert published its announcement on June 5, 2025, claiming to have compromised the data of Columbia TI. To support their claim of a successful breach, the group has provided visual evidence in the form of screenshots. These images appear to show various documents that suggest the compromise of both corporate and operational files. At this time, public information regarding the specific capabilities and background of the bert group remains limited.

The screenshots released by the threat actors provide a glimpse into the types of information that may have been exfiltrated. Based on the visual evidence provided by the group, the following types of documents and records are reportedly involved:

• Corporate contracts
• Tax records
• Administrative documents
• Labor law records

The inclusion of such diverse documentation suggests that the attackers may have gained access to internal management systems or file servers containing sensitive business intelligence.

About Columbia TI

Columbia TI, also known as Columbia Integração, is a technology company based in Brazil. The organization specializes in providing a wide range of IT solutions designed to support businesses through their digital transformation processes. Their service portfolio includes critical infrastructure support, cybersecurity services, and cloud computing solutions. Because the company provides essential digital services to other businesses, its operational security is vital to the stability of its client base.

Potential impact and organizational implications

The documents claimed to be leaked by bert may contain highly sensitive information regarding the operational processes and the legal status of Columbia TI. Such a breach carries significant risks for the organization. From a commercial perspective, the exposure of internal contracts and administrative records could negatively impact the company's reputation and lead to a loss of trust among its business partners. Furthermore, the nature of the leaked documents suggests potential secondary risks, such as the possibility of the data being used for targeted phishing attacks or identity theft.

Given the scale of the clients served by Columbia TI, the impact of this breach could extend throughout its supply chain. When a technology provider is compromised, the downstream effects can be felt by every organization that relies on their cloud or infrastructure services. Additionally, under the regulations set forth by Brazil's LGPD, the organization may be required to fulfill specific legal obligations regarding data breach notifications to the relevant authorities and affected individuals.

For organizations operating in the technology and IT services sector, such incidents highlight the importance of robust defensive measures. Common industry practices to mitigate these risks include the implementation of multi-factor authentication, rigorous patch management, and continuous monitoring of network traffic to detect unauthorized exfiltration. Furthermore, maintaining a comprehensive incident response plan and ensuring regular offline backups can help organizations manage the fallout of a potential breach and minimize operational downtime.