Construcciones Sala listed on Desolator ransomware leak site

• Ransomware group: Desolator
• Country: Colombia
• Sector: Manufacturing
• Announcement date: August 30, 2025

The threat actor known as Desolator has listed the Colombian organization Construcciones Sala on its leak site. According to the group's announcement, the breach involves a significant volume of stolen information, with the attackers claiming to have compromised over 300 GB of data from the company.

Details of the alleged attack

The Desolator group has published a listing alleging that a cyberattack against Construcciones Sala occurred on August 28, 2025. Through this announcement, the threat actors assert that they have successfully gained access to the organization's databases and various business documents. The group further claims that the organization's data has been both encrypted and exfiltrated during the incident.

In modern cyberattacks, particularly those involving ransomware, threat actors often employ a tactic known as double extortion. This method involves not only encrypting a victim's files to disrupt operations but also stealing sensitive data to use as leverage. By threatening to leak the stolen information on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential corporate and personal information.

Claimed data and affected information

The announcement made by the Desolator group specifies that a wide array of sensitive information has been leaked. The attackers claim to have exfiltrated company emails, customer information, and various business documents. Furthermore, the group asserts that personally identifiable information (PII) and all company databases are part of the leak.

In addition to the general categories of data, the threat actors claim that a specific file containing credentials for PostgreSQL database dumps is included within the exfiltrated data set. The specific types of data claimed to be involved include:

• Company emails
• Customer information
• Business documents
• Personally identifiable information (PII)
• Company databases
• Database credentials

About Construcciones Sala

Construcciones Sala is a construction and building materials company based in Colombia. The company operates in various construction projects and structural solutions.

Impact and security considerations

This alleged data breach may negatively impact the organization's operational continuity and customer trust. The exposure of personally identifiable information could create legal risks under Colombian data protection regulations. Additionally, the leak of emails and database credentials introduces secondary risks, as the organization may become a target for subsequent phishing attacks.

While information regarding the Desolator group remains limited, the nature of such breaches highlights the importance of robust security measures. When an organization faces a potential compromise of database credentials, it is often advisable to immediately rotate the leaked credentials and conduct a comprehensive security audit of all systems. Maintaining rigorous monitoring and implementing strong access controls are standard defensive steps used by organizations to mitigate the impact of unauthorized access and protect sensitive data from exfiltration.