RAC Consultoria listed on spacebears leak site

• Ransomware group: spacebears
• Country: Dominican Republic
• Sector: Professional Services
• Announcement date: September 17, 2025

Spacebears claims data breach at RAC Consultoria

The threat actor known as spacebears has listed data allegedly belonging to RAC Consultoria on its leak site. According to the announcement made on September 17, 2025, the group claims to have successfully targeted the organization, which is based in the Dominican Republic.

The group alleges that it gained access to the organization's data following a cyberattack that reportedly took place on September 13, 2025. This incident follows a pattern observed in modern cybercrime, where threat actors move away from traditional encryption-based ransomware to focus on data exfiltration and extortion. In such scenarios, instead of merely locking a victim's systems, the attackers prioritize stealing sensitive information to use as leverage during negotiations.

Details of the alleged data theft

While the specific volume of the stolen data and the exact ransom demand remain unknown, the group has identified several categories of compromised information. The announcement claims that the following types of data have been targeted and potentially exfiltrated:

• SQL database files
• Financial documents
• Employee personal data
• Client personal data

The presence of such diverse data types—ranging from technical database files to sensitive personal and financial records—indicates a significant potential impact on the organization's internal operations and its external relationships with clients and staff.

About RAC Consultoria

RAC Consultoria is a consulting firm founded in 2008 that provides solutions to companies in areas such as human resources management, labor consulting, project management, and organizational restructuring. The firm focuses on helping businesses improve their internal processes and effectively achieve their strategic objectives.

Risk assessment and industry implications

This claim against RAC Consultoria may pose secondary risks such as identity theft and targeted phishing attacks for employees and clients. The alleged compromise of financial documents and personal data could damage the organization's commercial reputation and may trigger legal proceedings under data protection regulations in the Dominican Republic.

The spacebears group's focus on data exfiltration increases the risk that the stolen data could be sold to third parties or made public. Because the group prioritizes the theft of information over the encryption of files, the threat of public exposure remains a primary driver for extortion. The uncertainty regarding the group's technical capabilities makes it difficult to fully assess the scope and impact of the attack at this stage.

For organizations operating in the professional services sector, such incidents highlight the critical importance of robust data protection frameworks. When sensitive client and employee information is at risk, organizations are often advised to notify affected parties and review their security posture. Common defensive steps for organizations facing such threats include implementing strict access controls, enhancing monitoring for unauthorized data transfers, and ensuring comprehensive encryption for data both at rest and in transit. Given the nature of the leaked data, a thorough investigation into the breach is necessary to mitigate further damage to the organization's reputation and legal standing.