FM.GOB.AR targeted by Monti ransomware group in alleged data leak

• Ransomware group: Monti
• Country: Argentina
• Sector: Government & Defense
• Announcement date: March 2, 2025

Monti ransomware group claims data leak against FM.GOB.AR

The ransomware group known as Monti has published an announcement on its leak site, claiming to have obtained data belonging to FM.GOB.AR. This announcement, which appeared on March 2, 2025, marks a targeted action against the institution, with the group asserting that the compromised information is part of a complete data set.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat of releasing this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. By publishing the data, the attackers aim to damage the victim's reputation and create significant operational and legal pressure.

Details of the claimed event

According to the announcement made by the Monti group on March 2, 2025, the threat actor targeted FM.GOB.AR and labeled the incident as a "Full leak." This terminology suggests that the group intends to release the entirety of the data they claim to have stolen from the organization. To facilitate access to the alleged stolen information, the group provided a download link within their leak site announcement.

While the group has signaled that the leak is comprehensive through their use of the term "Full leak," they have not provided a detailed breakdown or a specific inventory of the files involved. The announcement lacks specific details regarding the volume of the data or the exact nature of the files contained within the provided link.

The organization involved

FM.GOB.AR serves as the official web portal for the Ministry of Economy of the Argentine Republic. This government institution holds a critical role in the nation's administration, as it is responsible for managing the country's fiscal, economic, and budgetary policies. Because of its central role in the national economy, the digital infrastructure of such an institution is a high-value target for various types of cyber threats.

Potential risks and implications

The alleged leak of data from a government entity like the Ministry of Economy carries significant implications. This incident may bring the risk of exposure for the institution's digital assets and sensitive information. When government institutions are targeted in this manner, such actions could potentially pave the way for secondary risks, including identity theft or highly targeted phishing attacks against employees or citizens.

Furthermore, the institution may face legal obligations under Argentine data protection regulations, which could trigger various administrative processes. The scale and nature of such leaks can create negative impacts on the institution's overall operational security. To defend against these types of threats, organizations in the government and defense sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized exfiltration, and ensuring regular, offline backups are maintained to mitigate the impact of encryption-based attacks.

The group responsible for this claim, Monti, currently has limited public information available regarding its specific methods or infrastructure. However, the act of targeting a major government economic portal highlights the ongoing risks faced by public sector entities in the current threat landscape.