ralord ransomware group lists pereclaver.org on its leak site

• Ransomware group: ralord
• Country: Spain
• Sector: Education
• Announcement date: March 28, 2025

The ralord ransomware group claims a data breach at pereclaver.org

The threat actor known as ralord has listed the organization pereclaver.org on its dedicated leak site. According to the announcement made on March 28, 2025, the group claims to have successfully exfiltrated a significant amount of data belonging to the entity. This listing follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure victims by threatening to release sensitive information.

The group claims to have obtained approximately 50 GB of data. Information regarding the specific identity and operational details of the ralord group remains limited in the public domain, making it difficult to ascertain their full scope or technical capabilities. Such incidents are typical of double extortion tactics, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage for ransom demands.

Details of the claimed data theft

The announcement made by the threat actor specifies that the stolen information includes a wide variety of sensitive files and records. The contents mentioned in the leak site post suggest a deep intrusion into the organization's digital infrastructure. The claimed data includes:

• Credentials
• Payment records
• Project source codes
• Corporate documents

Beyond these specific categories, the group also claims to possess secret reports, private plans, Excel files, and PDF documents. The presence of such diverse file types indicates that the attackers may have had access to various departments within the organization, ranging from administrative and financial sectors to technical development teams.

About pereclaver.org

Pere Claver Grup is a private, non-profit organization established in 1948 in Barcelona. The organization operates extensively within the fields of education and social services. With a professional team consisting of over 800 professionals, the group carries out a wide range of social and educational projects aimed at supporting the community.

Potential impact and organizational risks

The alleged data leak poses significant risks to the organization, particularly concerning regulatory compliance. Since the organization operates in Spain, the exposure of such data may constitute a major breach under the General Data Protection Regulation (GDPR) frameworks. The inclusion of credentials and payment records in the claimed data set introduces substantial risks of identity theft and fraud for both employees and the individuals receiving services from the organization.

Furthermore, the exposure of corporate project source codes and private plans could compromise the organization's intellectual property and weaken its competitive position. Such a breach can also lead to severe reputational damage and may facilitate secondary attacks, such as phishing or social engineering, targeting the organization's stakeholders. To mitigate such risks, organizations in the education and social services sectors typically focus on implementing robust security measures, including multi-factor authentication, regular data encryption, and comprehensive employee training to defend against evolving cyber threats.