Peroni Sosa Tellechea Burt & Narvaja listed on payload ransomware leak site

• Ransomware group: payload
• Country: Uruguay
• Sector: Professional Services
• Announcement date: April 23, 2026

Peroni Sosa Tellechea Burt & Narvaja listed on payload ransomware leak site

The ransomware group known as payload has listed the Paraguayan law firm Peroni Sosa Tellechea Burt & Narvaja on its leak site. According to the announcement made on April 23, 2026, the group claims to have successfully targeted the organization, marking a significant incident for the professional services sector in the region.

The claims made by payload

The payload group has asserted that they gained unauthorized access to the internal systems of Peroni Sosa Tellechea Burt & Narvaja. Following this alleged intrusion, the group claims to have exfiltrated a significant amount of data from the firm's environment. While the group has taken responsibility for the attack on their leak site, information regarding the specific identity, technical methods, or broader history of the payload group remains limited in the public domain.

The announcement was made on April 23, 2026, which coincides with the date the group claims the attack occurred. This type of public listing is a common tactic used by ransomware actors to exert pressure on their victims.

Details regarding the allegedly leaked data

The group has provided specific information regarding the volume of the data they claim to have stolen, though they have not provided a breakdown of the specific file types or contents. The information provided by the group is as follows:

• The total size of the allegedly exfiltrated data is 27 GB.

Aside from the stated size of 27 GB, no specific details regarding the content of the allegedly leaked data have been provided by the group.

About Peroni Sosa Tellechea Burt & Narvaja

Peroni Sosa Tellechea Burt & Narvaja is one of the largest and most prestigious law firms in Paraguay. Founded in 1968, the firm has established a long-standing presence in the legal sector. The firm provides comprehensive legal services across various practice areas, including corporate law, tax law, agribusiness, and regulatory compliance.

Implications and industry considerations

This incident highlights the inherent risks faced by professional services firms. Given that law firms handle sensitive client information, this breach may pose risks to client confidentiality and attorney-client privilege. Due to the nature of the firm's practice areas, the leaked data could potentially contain trade secrets, legal contracts, or personal information.

Such an incident may damage the firm's reputation and could lead to legal sanctions under applicable regulations. Furthermore, there is a possibility that the leaked data could be utilized in secondary attacks or targeted phishing campaigns. Considering the group's methods and motivations, the publication of this data may be viewed as part of a double-extortion strategy.

Double-extortion is a common ransomware technique where attackers not only encrypt a victim's data but also steal it, threatening to release it publicly unless a ransom is paid. This increases the leverage held by the attackers. To defend against such threats, organizations in the legal sector often implement robust security measures, such as multi-factor authentication, regular security awareness training, and comprehensive data encryption, to protect sensitive client communications and proprietary legal documents.