Dr Damiel Pugliese data allegedly listed by Lamashtu ransomware group

• Ransomware group: Lamashtu
• Country: Argentina
• Sector: Healthcare
• Announcement date: September 30, 2026

Lamashtu claims data breach against Dr Damiel Pugliese

The Lamashtu ransomware group has listed a dataset on its leak site that allegedly belongs to Dr Damiel Pugliese. According to the group's announcement, the breach involves a significant volume of sensitive information. The group claims to have accessed a total of 35 GB of data, which is comprised of approximately 90,000 files. This announcement was made on September 30, 2026, coinciding with the date the group alleges the attack occurred.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion. In a double extortion scheme, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process. The threat of leaking this stolen data publicly serves as additional leverage to coerce the victim into meeting ransom demands. While the specific ransom demand in this instance was not disclosed, the presence of the data on a leak site indicates this high-pressure tactic is being utilized.

Details of the alleged data theft

The Lamashtu group claims that the stolen dataset contains a wide array of sensitive documents spanning a multi-year period. Specifically, the group alleges that the data includes client portfolio records, payroll information, and various tax documents dating from 2020 to 2026. The breadth of this timeframe suggests that several years of professional and financial history may be at risk.

The specific types of information allegedly contained within the 90,000 files include:

• Payroll records
• Tax filings
• Bank statements
• Invoices
• Tax identification numbers
• Salary receipts
• Social security information

The exposure of such diverse financial and personal identifiers presents significant risks to the individuals involved. When sensitive identifiers like tax identification numbers and social security information are leaked, they can be exploited by malicious actors for various fraudulent purposes.

About Dr Damiel Pugliese

Dr. Daniel Pugliese is a certified accountant and a graduate of the University of Buenos Aires. He is a registered professional with the Professional Council of Economic Sciences of Buenos Aires (C.P.C.E.C.A.B.A.). His professional activities involve providing specialized accounting and financial consulting services within Argentina.

Potential impact and risks

The sensitivity of the allegedly leaked data carries heavy implications for the affected parties. For the clients and employees of the organization, there is a heightened risk of identity theft and financial fraud. Furthermore, because the entity is based in Argentina, the breach may lead to complications regarding compliance with local data protection regulations. The public disclosure of such detailed financial and personal records can also facilitate targeted phishing attacks, where attackers use specific knowledge of an individual's finances to craft convincing fraudulent communications.

For organizations operating in the healthcare and professional services sectors, such incidents can have adverse effects on operational continuity and reputation management. To mitigate these risks, organizations typically focus on robust defensive measures. These include implementing strict access controls to limit data exposure, maintaining comprehensive logging and monitoring to detect unauthorized access early, and conducting regular security awareness training to help staff recognize phishing attempts. Additionally, ensuring that data is encrypted both at rest and in transit can provide a critical layer of defense against data exfiltration.

Information regarding the Lamashtu group remains limited in the public domain, making it difficult to attribute the attack to a specific known threat actor profile beyond the name provided on the leak site.