Stormous ransomware group lists www.americanadecolchones.com on its leak site

• Ransomware group: Stormous
• Country: Colombia
• Sector: Retail & E-Commerce
• Announcement date: October 27, 2025

Stormous claims to have compromised Americana de Colchones

The Stormous ransomware group has announced a new target, claiming to have published sensitive access information belonging to the Colombian organization Americana de Colchones. According to an announcement made on the group's leak site on October 27, 2025, the threat actors claim to have obtained credentials that provide access to the organization's internal network.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release stolen data. In many modern ransomware campaigns, groups employ a tactic known as double extortion. This involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to use as leverage. By threatening to leak proprietary or private data, attackers aim to increase the likelihood of a successful ransom payment, even if the victim has robust backup systems in place.

Details of the claimed attack

The claim made by the Stormous group suggests a significant breach of the organization's perimeter security. On October 27, 2025, the group announced that they possess VPN access credentials for the internal network of the mentioned organization. This information was listed on their dedicated leak site to demonstrate the validity of their access.

Despite the announcement, the group has not provided specific details regarding the scale of the incident. There has been no information provided regarding a ransom demand or the volume of data involved in this alleged breach. Furthermore, the announcement did not include any screenshots to verify the contents of the stolen data.

Affected data types

• VPN access credentials

About Americana de Colchones

Americana de Colchones is a Colombia-based retailer of mattresses, beds, and sleep products. The company specializes in selling various sleep solutions and home furniture to its customer base.

Security implications and defensive considerations

The claim made by Stormous suggests that the organization's internal network security may have been compromised. The exposure of VPN credentials is a critical security failure, as it could allow unauthorized parties to infiltrate the company's systems and lead to potential data breaches. Such an event may trigger legal processes under Colombian data protection regulations, as the integrity of the network and the privacy of associated data are at risk.

Given the Stormous group's claim of being politically motivated, it is possible that the attack could have secondary objectives beyond simple financial gain. When threat actors are motivated by political or ideological agendas, the nature of the attack may shift from traditional extortion to disruptive or reputational damage.

For organizations operating in the retail and e-commerce sectors, maintaining robust network security is essential. Common defensive steps that organizations can take to mitigate such risks include the implementation of multi-factor authentication (MFA) for all remote access points, such as VPNs, to ensure that stolen credentials alone are insufficient for entry. Additionally, organizations should regularly conduct security audits and monitor network traffic for unusual patterns that might indicate unauthorized access. Restricting network access and reviewing security protocols immediately following a suspected breach is a vital step in containment and remediation.