SAP América Latina e Caribe · Breach

The Gentlemen ransomware claims attack on SAP Latin America

Oct 26, 2026 · 1 min read

The Gentlemen ransomware group added SAP Latin America and Caribbean to its leak site on Oct 26, 2026 (UTC), claiming an attack on the regional arm that runs operations across about 10 countries, with Brazil as its largest market. The group has not shared details on the volume or type of data allegedly taken, the claim has not been independently verified, and SAP has not publicly confirmed a cyber incident. SAP customers and integrators in the region should watch for SAP-themed phishing and fake invoice or support requests.

By HIFY Radar newsroom Updated 10/26/2026 01:55 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The Gentlemen ransomware group added SAP Latin America and Caribbean to its leak site on Oct 26, 2026 (UTC). The group claims an attack on SAP's regional arm, which runs operations across about 10 countries, with Brazil as its largest market. The claim has not been independently verified, and SAP has not publicly confirmed a cyber incident.

Why it matters

If the claim holds, customer contracts, project files and partner data for thousands of large enterprises served by the regional unit could be exposed. SAP customers and integrators in the region may face SAP-themed phishing and fake invoice or support requests. The group has released no data so far.

What to do

Monitor official SAP channels for confirmation. Warn teams about SAP-themed phishing, fake invoices and fraudulent support requests. Review accounts and integrations connected to SAP in the region.

For the technical team

Affected: SAP América Latina e Caribe (braço regional da SAP) · SAP Latin America and Caribbean, SAP's regional arm running operations across about 10 countries with Brazil as its largest market, per the group's description. No products or versions cited.
Exploitation: Unverified claim. The Gentlemen group listed the victim on its leak site on Oct 26, 2026 (UTC), without details on the volume or type of data allegedly taken. Reported by Daily Dark Web. SAP has not publicly confirmed the incident.
Fix: No fix applicable. No incident confirmation from SAP.
More details: The listing came two days after a separate, unrelated actor claimed a 31 GB leak tied to SAP's Ecuador operations. Per the source's analyst note, the regional SAP unit holds customer contracts, project files and partner data for thousands of large enterprises.