BAM.COM.GT Listed by Clop Ransomware Group

On July 11, 2023, Guatemalan bank Banco Agromercantil de Guatemala, S.A. (BAM) appeared on the leak site operated by the Clop ransomware group. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of records affected and the specific data types remain undisclosed by both the group and the bank.

Primary Disclosure Details

The Clop leak site entry for bam.com.gt states that the financial institution suffered a ransomware intrusion in which attackers successfully removed internal files before encryption. No victim count, ransom amount, or detailed inventory of stolen material is published on the listing. The disclosure follows Clop’s standard pattern of posting proof-of-exfiltration samples and threatening full data release if payment is not received. Public reporting on Clop indicates the group typically provides a short negotiation window before publishing or selling the material on underground forums.

Why This Matters for You and Your Family

When a regional bank’s internal files leave its network, the exposure can reach far beyond corporate walls. Customers, employees, vendors, and their families frequently appear in loan applications, payroll records, wire-transfer logs, and scanned identification documents. Even without an exact record count, the breach represents a high risk that personally identifiable information tied to your financial relationship with BAM has been taken. Once that material surfaces on dark-web markets, it can be used for identity theft, fraudulent loan applications in your name, or targeted phishing campaigns against you and your household.

Doxxing and Identity-Chain Implications

Internal bank files often contain linked datasets: email addresses, phone numbers, physical addresses, dates of birth, and government-issued ID copies. Attackers and subsequent buyers can chain these elements with usernames discovered in other breaches, creating a detailed profile that follows you across online services. Credential leaks of this nature frequently cascade into account takeovers on retail, social-media, and gaming platforms. Children’s gaming accounts that reuse an exposed parent email or phone number become especially vulnerable entry points for doxxing chains that ultimately map back to the family’s real-world identity and home address.

Clop’s Publicly Known Track Record

Public reporting attributes Clop’s emergence to 2019 as a ransomware-as-a-service operation. The group gained notoriety in 2021–2023 after compromising large enterprises through vulnerabilities in file-transfer software such as MOVEit and GoAnywhere. Notable prior victims include multinational corporations in finance, healthcare, and logistics sectors. Clop’s typical playbook involves initial access via exploited remote-desktop or supply-chain vulnerabilities, followed by extensive internal reconnaissance, data exfiltration, and then dual extortion: demanding ransom to prevent encryption and a second payment to stop data publication. The group maintains a professional leak site that lists victims by domain and posts sample documents as leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at BAM or bam.com.gt everywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same compromised email or address.
• Let the remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing day-to-day accounts.

The incident underscores that financial institutions in Latin America remain attractive targets for sophisticated ransomware operators who prioritize data theft over immediate encryption. A single listing on a leak site can trigger months of downstream identity risk for every customer and employee. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that explicitly includes children’s gaming accounts—capabilities designed precisely for the cascading exposures this type of breach creates. Start your DoxxScan trial today and treat this incident as the prompt to lock down every linked piece of your digital life before the next wave of misuse begins.