Moondancer Claims Compunet Breach, Leaks Mitsubishi Electric Colombia Data
The Moondancer ransomware group claims on a dark web forum that it breached Compunet S.A., a Colombian IT provider, and is leaking data it attributes to Mitsubishi Electric Colombia. The group alleges full admin access to the virtual environment (30+ ESXi hosts, about 270 VMs), 270 TB encrypted and 60 TB of backups deleted, including three backup appliances. Nothing has been independently verified; Compunet clients should review remote access, admin accounts and backup isolation.
What happened
The Moondancer ransomware group claims on a dark web forum that it breached Compunet, a Colombian IT provider, and started leaking data it attributes to Mitsubishi Electric Colombia. According to the group, 270 TB were encrypted and 60 TB of backups deleted. None of this has been independently verified.
Why it matters
If genuine, this is a supply-chain attack: one IT provider's compromise exposes its customers. The group says data from several other Compunet clients was sold privately and cites 59 million database rows and about 110,000 invoices. Compunet's operations and client data confidentiality are at stake.
What to do
Compunet clients should review remote access, admin accounts and backup isolation now. Contact Compunet to understand the scope and check whether their own data appears in the leak.
For the technical team
- Affected
- Compunet S.A., provedora colombiana de consultoria e serviços de TI; dados atribuídos à Mitsubishi Electric Colombia ale · Compunet S.A., a Colombian IT consulting and services firm; data attributed to Mitsubishi Electric Colombia; virtual environment with 30+ ESXi hosts and about 270 VMs, per the group.
- Exploitation
- Ongoing leak announced by the group on a dark web forum; ransom talks reportedly failed and data from several other clients reportedly sold privately. Unverified claim reported by DailyDarkWeb.
- Fix
- No fix applicable (data breach incident).
- Vector
- Full admin access to the victim's virtual environment, per the group; initial access vector not disclosed.
- More details
- Group alleges 270 TB encrypted, 60 TB of backups deleted including three backup appliances, 59 million database rows and about 110,000 invoices taken. DailyDarkWeb flags it as an unverified threat-actor claim, not confirmation of a breach.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
