Workers Informática Ltda listed on Killsec ransomware leak site

• Ransomware group: Killsec
• Country: Brazil
• Sector: Technology
• Announcement date: April 1, 2025

Killsec claims data breach at Workers Informática Ltda

The threat actor known as Killsec has officially listed the Brazilian technology company Workers Informática Ltda on its dedicated leak site. According to the announcement, which was posted on April 1, 2025, the group claims to have obtained sensitive data belonging to the organization. This development follows the group's pattern of targeting various sectors to exert pressure on victims through public exposure.

The incident involves a claim of data theft rather than a simple encryption event. In such scenarios, ransomware groups often utilize a tactic known as double extortion. This method involves not only encrypting an organization's local files to disrupt operations but also exfiltrating sensitive information to a remote server. The threat actor then threatens to publish this stolen data on a public leak site if the victim fails to meet specific demands, thereby leveraging the threat of reputational damage and regulatory scrutiny to compel payment.

Details of the claim and the ongoing threat

The Killsec group has initiated a countdown timer on their leak site, a common psychological tactic used by ransomware operators to increase pressure on the victim. The group has stated that the data may be leaked if the institution does not meet their ransom demands. While the specific amount of the ransom demand has not been disclosed in the announcement, the threat of public exposure remains active as the countdown progresses.

The announcement was added to the group's site on April 1, 2025, and the group claims the attack occurred on the same day. This rapid succession between the attack and the listing is characteristic of modern ransomware operations aiming to maximize chaos and minimize the victim's response time. At this stage, the group's claims regarding the breach have not been independently confirmed.

Reported data types involved in the breach

Based on the information provided in the leak site announcement, the group has provided screenshots that appear to display various file lists. The data identified in these screenshots includes several categories of sensitive information:

• Financial records
• Backup files
• Client information
• Email server data
• Project files

The presence of email server data, specifically mentioning MDaemon and Outlook, suggests that the attackers may have gained access to internal communications. Such access can be highly damaging, as it provides a roadmap of the organization's internal operations and communication patterns.

About Workers Informática Ltda

Workers Informática is a Brazil-based information technology and software solutions company. The organization provides a wide range of services to its corporate clients, including IT infrastructure, system integration, and technical support services. Given its role in providing IT and software solutions, the company occupies a critical position within the technology sector, serving as a foundational service provider for its client base.

Potential impact and industry implications

This incident indicates that sensitive corporate and client data within Workers Informática Ltda may be at risk of exposure. Because the organization is based in Brazil, the breach may lead to significant legal consequences under the LGPD (General Data Protection Law), which governs how personal data must be protected and handled within the country. The potential exposure of financial records and email communications could lead to secondary attacks, such as identity theft or highly targeted phishing campaigns directed at the company's employees and its clients.

The Killsec group, which emerged in 2023 and is known to provide ransomware-as-a-service, represents a growing class of professionalized cybercriminal entities. Such groups often provide the tools and infrastructure necessary for other actors to conduct sophisticated attacks, making the threat landscape more volatile. For organizations in the technology and IT services sector, such incidents highlight the critical importance of robust defense-in-depth strategies.

To mitigate the risks associated with double extortion, organizations typically focus on several key defensive pillars. These include maintaining offline, immutable backups to ensure operational continuity and implementing strict access controls to limit the lateral movement of attackers. Furthermore, monitoring for large-scale data exfiltration and enhancing email security protocols are essential steps in defending against the types of data theft claimed in this incident. The potential for both operational disruption and long-term reputational damage makes these types of breaches a high-priority concern for modern enterprises.