Prosegur listed on Worldleaks leak site following alleged data breach

• Ransomware group: Worldleaks
• Country: Singapore
• Sector: Professional Services
• Announcement date: August 23, 2025

Worldleaks claims responsibility for Prosegur data breach

The threat actor known as Worldleaks has listed the organization Prosegur on its dedicated leak site. According to the announcement made on August 23, 2025, the group claims to have obtained data belonging to the organization, marking a new development in the group's ongoing extortion activities.

This incident follows a pattern of behavior observed in modern cyber extortion. Ransomware groups frequently use leak sites to pressure victims by threatening to release sensitive information to the public. Such platforms serve as a public bulletin for the group's successes, often used to damage the reputation of the targeted entity or to demonstrate the efficacy of their exfiltration methods.

Details of the alleged attack

According to the claims made by Worldleaks, the group gained unauthorized access to the organization's networks on July 18, 2025. This suggests that the attackers may have maintained a presence within the network for several weeks before the public announcement was made on their platform.

Worldleaks is a group that has emerged following the cessation of encryption activities by Hunters International. Unlike traditional ransomware operations that focus on encrypting files to disrupt business operations, Worldleaks is reported to focus exclusively on data exfiltration and extortion. This shift in tactics highlights a trend in the cybercrime landscape where threat actors prioritize the theft of information over the disruption of systems, often employing what is known as a double-extortion strategy.

In a double-extortion scenario, attackers do not merely lock a company out of its own data; they steal the data first. This allows them to demand payment not just for the decryption of files, but also to prevent the public release of sensitive information. This method increases the pressure on an organization, as the threat of a data leak can be more damaging to a company's reputation and legal standing than a temporary operational outage.

Information regarding the leaked data

At this stage, there are no details or sample files provided regarding the nature of the alleged leaked data. The listing does not specify the volume of data stolen or the specific types of files that were accessed during the breach.

About Prosegur

Prosegur is a global security company providing cash management, electronic security systems, and cybersecurity solutions. Its Singapore branch provides logistics and security services to corporate clients in the region.

Potential impact and organizational implications

This incident may result in the exposure of the organization's operational data and employee information. Because the organization is based in Singapore, the breach may trigger legal proceedings under the local data protection regulation, the Personal Data Protection Act (PDPA).

The publication of stolen data can lead to several secondary risks for an organization, including:

• A loss of trust among customers and business partners.
• Risks of identity theft involving the stolen information.
• Increased vulnerability to targeted phishing attacks.

For organizations operating in the professional services and security sectors, maintaining robust defensive measures is critical. Common defensive steps to mitigate such risks include implementing strict access controls, monitoring for unauthorized data exfiltration, and ensuring comprehensive encryption of sensitive data at rest and in transit. Furthermore, regular audits of network access and employee training on phishing awareness are essential components of a modern cybersecurity posture to defend against the specialized tactics used by groups focusing on data theft.