Createinfor.pt listed on m3rx ransomware leak site

• Ransomware group: m3rx
• Country: Portugal
• Sector: Professional Services
• Announcement date: July 26, 2026

The threat actor group known as m3rx has officially listed the organization createinfor.pt on its dedicated leak site. This announcement, made on July 26, 2026, includes an allegation that the group has successfully compromised the organization's data, marking a potential data breach for the Portuguese entity.

Details of the m3rx claim

According to the announcement posted on the group's platform, the m3rx group claims to have gained unauthorized access to the systems of createinfor.pt. The claim was made on July 26, 2026, the same day the entity was added to the leak site. While the group has taken credit for the intrusion, public information regarding the specific operations, tactics, or long-term patterns of the m3rx group remains limited in the public domain.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's files to disrupt operations but also threaten to publish sensitive information on public platforms if a ransom is not met. This tactic is designed to exert maximum pressure on the victim by threatening reputational damage and regulatory scrutiny. By listing a target on a leak site, the group signals to the public and the victim that they are in possession of data that they intend to use as leverage.

Information regarding the alleged stolen data

At this stage, the threat actor has not provided specific details regarding the nature or the volume of the compromised data. No information has been provided regarding the specific content of the alleged stolen data, nor has any information been shared regarding the total file count or the size of the data exfiltrated. The listing currently names no specific data types.

The lack of transparency from the threat actor is a common occurrence during the early stages of a leak site announcement. Without a detailed manifest of stolen files, it is difficult to determine the exact scope of the incident or the specific sensitivity of the information involved. Organizations facing such claims must often conduct thorough forensic investigations to verify the extent of the breach and identify exactly what information may have been accessed by the attackers.

About createinfor.pt

CreateInfor is a repair services company based in Caldas da Rainha, Portugal. It operates as a small-scale business providing technical service and maintenance solutions within the professional services sector.

Risk assessment and industry implications

The potential compromise of the organization's data may pose secondary risks such as identity theft or targeted phishing attacks against employees and clients. Because the organization is based in Portugal, any data breach may lead to legal and administrative consequences under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict protocols regarding the protection of personal data and the timely notification of authorities and affected individuals in the event of a breach.

Furthermore, given that the organization operates in the professional services sector, there could be a risk of supply chain attacks targeting its business partners. In a supply chain attack, a threat actor targets a smaller or less secure service provider to gain access to the larger, more secure networks of their clients or partners. This makes the security posture of service providers a critical component of the broader digital ecosystem.

The accuracy of the threat actor's claims and the scope of the leaked data remain unverified. In such situations, organizations typically need to review their cybersecurity posture and notify relevant authorities. General defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for staff to mitigate the risks of phishing and unauthorized access.