spacebears ransomware group lists Supercash (Reuploaded) on its leak site

• Ransomware group: spacebears
• Country: Spain
• Sector: Hospitality
• Announcement date: October 20, 2025

Spacebears claims data compromise at Supercash

The threat actor known as spacebears has published a leak announcement on its dedicated leak site, claiming to have compromised data belonging to Supercash. This announcement, which was discovered on October 20, 2025, includes a "reuploaded" label, which suggests that the data may have been previously published by the group.

According to the claims made by the threat actor, the breach was not a direct intrusion into the organization's primary infrastructure but was instead facilitated through a third-party service provider. Specifically, the group alleges that the breach was made possible through Gesimde Asociados S.L., a company that provides services to Supercash. This type of incident highlights a growing trend in the cyber threat landscape where attackers target the supply chain to gain access to larger, more lucrative organizations.

The scope of the alleged data leak

While the specific volume of the stolen data and the exact file count have not been disclosed by the group, the announcement identifies several categories of sensitive information that have allegedly been exfiltrated. The leaked data is claimed to include a variety of critical records that could impact both the business operations and the privacy of individuals associated with the company.

The information allegedly involved in this breach includes:

• Database records
• Employee personal information
• Client personal information
• Financial documents

The exposure of such diverse data types—ranging from internal databases to sensitive personal and financial documents—presents a multifaceted risk to the organization and the individuals whose information is contained within those records.

About Supercash

Supercash is a wholesale company with over 40 years of experience operating in the northern region of Spain. Offering a wide range of products for the hospitality industry, the company provides services through five 'cash and carry' centers.

Analysis and implications of the breach

This alleged breach may pose significant data privacy risks for Supercash and its service provider, Gesimde Asociados S.L. For entities operating in Spain, such an incident could lead to legal obligations and administrative sanctions under the GDPR (EU General Data Protection Regulation). The exposure of employee and client data may increase the likelihood of affected individuals being subjected to identity theft or targeted phishing attacks.

The spacebears group's focus on data exfiltration and negotiation suggests that the stolen data could be utilized as a tool for secondary extortion. In modern ransomware campaigns, groups often employ a "double extortion" tactic. In this scenario, attackers do not just encrypt a victim's systems to demand a ransom for decryption; they also steal sensitive data and threaten to leak it publicly unless a second ransom is paid. This increases the pressure on the victim, as the threat of a public data leak can cause significant reputational and regulatory damage, even if the organization can successfully restore its systems from backups.

Furthermore, this incident, which is claimed to have occurred via a third-party supply chain, highlights the necessity for organizations to audit the security processes of their business partners. Organizations must recognize that their security perimeter extends to the vendors and service providers they rely upon. A vulnerability in a third-party provider can serve as a gateway into the primary organization's environment.

To mitigate these risks, organizations in the hospitality and wholesale sectors should consider implementing rigorous third-party risk management programs. This includes conducting regular security audits of vendors, enforcing strict access controls for service providers, and ensuring that all partners adhere to high standards of data protection. Continuous monitoring of the supply chain and maintaining a robust incident response plan that accounts for third-party compromises are essential components of a modern defensive posture.