Grupo Riquelme listed on nightspire leak site

• Ransomware group: nightspire
• Country: Paraguay
• Sector: Agriculture and Food Production
• Announcement date: June 25, 2026

Nightspire claims data breach at Grupo Riquelme

The threat actor group known as nightspire has published an announcement on its leak site claiming to possess data belonging to Grupo Riquelme. This listing, which appeared on June 25, 2026, alleges that the group has obtained unauthorized access to the entity's internal information. While the group has made these claims, information regarding the specific tactics and motivations of nightspire remains limited.

The incident, which the group claims occurred around June 13, 2026, involves the potential exposure of various operational and financial records. Such incidents are common in the landscape of modern cybercrime, where threat actors often employ double extortion tactics. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to pressure the victim into paying a ransom by threatening to leak the information publicly.

Details of the alleged data theft

According to the announcement made by nightspire, the leaked data allegedly includes a wide variety of sensitive information. The group claims to have access to several critical categories of organizational data, which could significantly impact the company's operations and privacy. No screenshot was provided by the group to verify the contents of the alleged leak.

The data types mentioned in the claim include:

• Full database backups
• Banking and financial data
• Accounting and ledger records
• Customer databases
• HR and workforce data
• User, role, and permission data
• ERP and critical business application data

The disclosure of such extensive datasets, ranging from financial records to human resources information, represents a significant security event for the targeted organization.

About Grupo Riquelme

Grupo Riquelme is a Paraguay-based company operating in the agriculture and food production sector. The organization focuses on the processing of agricultural products and food supply chain management. Given its role in the food supply chain, the company's operational stability is vital to its regional industry.

Potential impact and security implications

This alleged breach may expose employees and customers of Grupo Riquelme to various risks, such as identity theft, due to the sensitive nature of the claimed data. Furthermore, the disclosure of financial and ERP data could potentially lead to the compromise of trade secrets and the disruption of operational processes. Because the entity is based in Paraguay, it may face legal challenges regarding compliance with local data protection regulations.

The leaked information could potentially be utilized in secondary attacks or targeted phishing campaigns against the company or its stakeholders. In the agriculture and food production sector, such attacks can be particularly disruptive to supply chain management and production schedules. Organizations in this sector often face risks related to the theft of proprietary processing methods or logistical data.

To mitigate such risks, organizations typically implement defensive measures such as multi-factor authentication, regular security awareness training, and robust encryption for data at rest and in transit. Additionally, maintaining offline backups and implementing strict access controls for ERP and financial systems are common strategies used to defend against unauthorized access and data exfiltration.

• Affected data types:
• Financial data
• Accounting records
• Customer databases
• HR data
• ERP data