Empresa de Transportes Via Pajuçara Ltda. targeted by incransom

• Ransomware group: incransom
• Country: Brazil
• Sector: Transportation
• Announcement date: February 27, 2026

Empresa de Transportes Via Pajuçara Ltda. listed on incransom leak site

The incransom ransomware group has officially listed the Brazilian transportation company Empresa de Transportes Via Pajuçara Ltda. on its dedicated leak site. According to an announcement published on February 27, 2026, the threat actor group claims to have successfully exfiltrated a significant volume of data belonging to the organization. This listing follows a claimed attack date of February 26, 2026.

Details of the claimed data exfiltration

The incransom group alleges that the breach involved a substantial amount of sensitive information. The group claims to have accessed a total of 209 GB of data, which consists of approximately 78,651 files. The leaked information reportedly includes operational and administrative contact information, as well as a wide variety of internal documentation. While the group has not specified a ransom demand, the scale of the claimed theft suggests a significant breach of the organization's digital environment.

Based on the evidence provided by the attackers, the compromised data includes various sensitive categories. Specifically, the group has shared samples that appear to contain:

• Identity information
• Personal documents
• Corporate documents

The presence of these document types in the leak suggests that the attackers have gained access to highly sensitive files, including identity cards and corporate records, which could pose long-term risks to the affected parties.

About Empresa de Transportes Via Pajuçara Ltda.

Empresa de Transportes Via Pajuçara Ltda. is a company based in Brazil that operates within the transportation and logistics services sector. The organization's primary business activities involve passenger transport and various related logistics operations. Given the nature of its services, the company handles a significant amount of logistical data and personal information related to its operations and clientele.

Analysis and potential implications of the breach

The incransom group, which first emerged in mid-2023, is known for employing double-extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems but also steal sensitive data to use as leverage. By threatening to leak this information on public forums, the group attempts to pressure the victim into paying a ransom to prevent the exposure of private data. This method significantly increases the pressure on an organization, as the threat of reputational damage and legal consequences remains even if systems are restored from backups.

The exposure of personal data belonging to both employees and customers significantly elevates the risk of identity theft and targeted phishing attacks. When identity cards and personal documents are leaked, malicious actors can use this information to impersonate individuals or craft highly convincing social engineering campaigns. Furthermore, the leak of corporate documents may provide a foundation for secondary attacks against the organization's business operations, potentially allowing attackers to understand internal processes or target business partners.

From a regulatory perspective, this incident may trigger specific legal obligations. Under Brazil's General Data Protection Law (LGPD), the organization may face requirements to notify relevant authorities and affected individuals regarding the data breach. Failure to comply with such regulations can lead to potential legal sanctions. To mitigate such risks, organizations in the transportation and logistics sector are generally encouraged to implement robust data protection frameworks, maintain strict access controls, and ensure continuous monitoring of their networks to detect unauthorized exfiltration early.