GrimGroup claims leak of Ufinet fiber network maps and emails
A threat actor linked to GrimGroup published a dataset allegedly taken from Ufinet LatAm, a wholesale fiber-optic carrier in Spain and Latin America. The material includes 1,759 corporate emails and exact GPS coordinates for over 400,000 poles and 296,000 cables, plus manholes, ducts and splices. The claim has not been confirmed by the carrier.
What happened
A threat actor linked to GrimGroup has published a dataset it claims was taken from Ufinet LatAm, a wholesale fiber-optic carrier in Spain and Latin America. The material allegedly exposes 1,759 corporate emails and GPS coordinates for over 400,000 poles and 296,000 cables. Ufinet has not confirmed any incident.
Why it matters
According to the post, the data touches 44 carriers, reportedly including AT&T, Telefonica and Verizon. Precise maps of physical telecom infrastructure create sabotage and physical-security risk, on top of privacy risk. The email list could fuel targeted phishing against Ufinet staff and partner carriers.
What to do
Treat as an unverified claim and seek official confirmation from Ufinet. Warn teams about phishing aimed at the disclosed emails. If the company uses Ufinet or cited carrier circuits, review physical protection and monitoring of critical network sites.
For the technical team
- Affected
- Ufinet LatAm, operadora atacadista de fibra óptica presente na Espanha e na América Latina · Ufinet LatAm, wholesale fiber-optic carrier in Spain and Latin America (alleged target). According to the post, the network data touches 44 carriers, reportedly including AT&T, Telefonica and Verizon.
- Exploitation
- No exploitation reported. Leak claim published by a threat actor linked to GrimGroup and reported by Daily Dark Web, which classifies it as an unverified threat-actor claim, not confirmation of a breach. Ufinet has not confirmed any known incident.
- Fix
- No software to update
- More details
- The published dataset includes files ready to load into mapping software and locations of manholes, ducts and splices with exact GPS coordinates. Daily Dark Web analyst note: precise maps of physical infrastructure are a sabotage and physical-security risk, and the email list could fuel targeted phishing against Ufinet staff and partner carriers. How the data was obtained is not described in the source.
Timeline
First record of the case: publication of data allegedly taken from Ufinet LatAm.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
