dxon.com.br listed on 0day Syndicate leak site

• Ransomware group: 0day Syndicate
• Country: Brazil
• Sector: Professional Services
• Announcement date: May 28, 2026

The Brazilian data intelligence company dxon.com.br has been listed on a ransomware leak site by the threat actor known as 0day Syndicate. According to the announcement made on May 28, 2026, the group claims to have successfully breached the organization's systems.

The claimed attack and failed negotiations

The 0day Syndicate group has posted an announcement claiming they have gained unauthorized access to the systems of dxon.com.br. Specifically, the threat actor asserts that the access was obtained within the institution's environments related to their data analytics and fraud prevention solutions. This type of intrusion is characteristic of double extortion tactics, where attackers not only encrypt a victim's systems but also exfiltrate sensitive information to use as leverage during ransom negotiations.

The group's announcement indicates that the negotiation process between the attackers and the organization has failed. In such scenarios, ransomware groups typically move from private negotiations to public pressure by publishing stolen data on their leak sites to coerce the victim into paying. The listing appeared on the group's platform on May 28, 2026, the same day they claim the attack occurred.

Data involved in the leak

The threat actor claims that the volume of data stolen during the incident amounts to 2TB. While the specific contents of the files have not been detailed by the group, it is assessed that the stolen information may include files related to the institution's data analytics and credit scoring processes. No specific information was provided regarding the exact file count or the specific ransom demand.

About dxon.com.br

DXON is a Brazilian company that provides data intelligence and fraud prevention solutions. The organization operates within the professional services sector and focuses on providing data analytics and compliance-related services to its clients.

Impact and potential risks

This security incident may create negative impacts on the data analytics and compliance solutions that the institution provides to its customers. Because the company handles sensitive data intelligence, the breach poses significant risks to the integrity of the services provided. Furthermore, there is a possibility that the leaked data could pose secondary risks and supply chain attacks for other businesses served by the institution.

From a regulatory perspective, under Brazil's LGPD regulations, administrative sanctions may be observed if the institution fails to meet its data protection obligations. Additionally, the breach increases the risks of identity theft and targeted phishing for the institution's customers. Public information regarding the 0day Syndicate group remains limited, making it difficult to attribute the attack to a specific known entity with high certainty.

For organizations operating in the professional services and data intelligence sectors, such incidents highlight the importance of robust defensive measures. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management, and ensuring comprehensive logging and monitoring to detect unauthorized access early. Organizations should also focus on data encryption and strict access controls to mitigate the impact of potential exfiltration.