Sus Insumos S.A.S targeted by Vect ransomware group

• Ransomware group: Vect
• Country: Colombia
• Sector: Agriculture and Food Production
• Announcement date: February 25, 2026

A ransomware leak announcement has been published claiming the compromise of data belonging to Sus Insumos S.A.S. The threat actor known as Vect has listed data allegedly belonging to the organization on its leak site, marking a significant potential security incident for the Colombian company.

The alleged attack and current status

According to the announcement published on February 25, 2026, the threat actor known as Vect claims to have successfully targeted Sus Insumos S.A.S. The group alleges that they have compromised a substantial amount of data, specifically claiming a total volume of 30.26 GB. This announcement is categorized as a data leak notification rather than a simple encryption event.

The threat actor states that negotiations with the organization are currently ongoing. However, the group has issued a warning that the stolen data may be published on their leak site if a ransom is not paid within a specified deadline. While the threat actor has made these claims, no specific ransom demand has been disclosed in the public announcement.

Data types involved in the claim

The listing provides details regarding the specific types of information that have allegedly been exfiltrated from the organization's systems. The claims include a variety of technical and business-related files, such as:

• Web server files
• Database records
• ERP data
• Accounting records
• Shared network data

The announcement further specifies that the compromised information includes local development environment files, database and SQL server directories, and business or accounting application data. It is important to note that no screenshots were provided by the threat actor to substantiate these claims.

About Sus Insumos S.A.S

Sus Insumos S.A.S is a Colombia-based supplier of agricultural and food products. The company operates in the sale and distribution of agricultural inputs, serving as a key participant in the regional supply chain for the agriculture and food production sector.

Risk assessment and implications

This incident suggests that sensitive commercial and operational data within Sus Insumos S.A.S may be at risk of exposure. The alleged compromise of ERP and accounting data could create secondary risks regarding the organization's financial processes and supply chain relationships. Such breaches often involve the theft of sensitive business intelligence that can be used to undermine a company's competitive position or disrupt its logistical operations.

Furthermore, if employee or customer information is included in the stolen datasets, it may lead to identity theft and targeted phishing attacks. Organizations facing such threats must be aware that the exposure of personal data can lead to significant reputational damage and legal consequences. Under Colombian data protection regulations, the organization may be required to fulfill specific data breach notification obligations to the relevant authorities and affected parties.

General context of ransomware extortion

This incident follows the pattern of double extortion, a common tactic used by modern ransomware groups. In this model, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat of leaking this data on a public leak site provides the attackers with additional leverage during negotiations, as the victim faces the risk of regulatory fines and loss of customer trust even if they can restore their systems from backups.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes maintaining robust, offline backups to ensure operational continuity and implementing strict access controls to limit the movement of attackers within a network. Monitoring for unusual data exfiltration patterns and ensuring all software, particularly web servers and database management systems, are patched against known vulnerabilities are also standard defensive measures used to mitigate the risk of such breaches.

Information regarding the specific capabilities and motives of the Vect group remains limited at this time.