createinfor.pt Listed by m3rx Ransomware Group

On July 26, 2026, Portuguese company CreateInfor.pt appeared on the leak site operated by the m3rx Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack on the repair-services firm headquartered in Caldas da Rainha, Portugal. The number of individuals whose data may have been exposed remains unknown, as neither the leak-site posting nor any subsequent company notification has disclosed specific record counts or data types.

Reported Details from the Listing

The m3rx leak site explicitly lists createinfor.pt as a victim and confirms that data was allegedly stolen in a ransomware incident. The disclosure indicates that internal files were taken, though it does not specify the volume or exact nature of the documents. No ransom amount or payment deadline is publicly detailed on the listing. CreateInfor operates in the vehicle and equipment repair sector, employs between 10 and 19 people, and generates annual revenue between €500,000 and €1 million. The primary source remains the onion address hosted on the m3rx extortion portal, mirrored via ransomware.live.

Why This Matters for You and Your Family

When a local business like CreateInfor suffers a breach, the people most at risk are ordinary customers whose repair records, invoices, contact details, and payment information may have been stored in the compromised internal files. If you or any member of your family has used their services in Caldas da Rainha or surrounding areas, your personal data could now sit in the hands of extortionists. Even without an exact victim count, the exposure of internal files in ransomware cases almost always includes names, addresses, phone numbers, email addresses, and sometimes national identification numbers or banking references. These details are more than enough for identity thieves to open accounts, file fraudulent taxes, or launch convincing phishing campaigns against you and your household.

The Doxxing and Identity-Chain Risk

Stolen internal files frequently contain spreadsheets that link customer names to phone numbers, vehicle registration plates, email addresses, and home addresses. Once published or sold, this information becomes the foundation of doxxing chains. Threat actors cross-reference it with credential leaks, social-media handles, and children’s online gaming accounts that reuse the same email or phone number. The result is a complete identity map that can lead to account takeovers, physical stalking, or targeted scams against every member of the household. DoxxScan by GalaxyWarden continuously monitors across 13.1 billion+ breach records and more than 100 platforms while performing AI-powered identity-chain mapping that reveals exactly how one leaked repair record can expose your entire digital footprint, including family and children’s gaming accounts.

m3rx Ransomware Group Track Record

Public reporting attributes the emergence of m3rx to late 2024. The group has since targeted small and medium-sized businesses across Europe and Latin America, focusing on companies with limited cybersecurity resources. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by rapid exfiltration of internal documents before deploying ransomware. Rather than always encrypting systems, m3rx often relies on data extortion alone, threatening to publish sensitive files unless payment is made. Notable prior victims include other small European service firms whose customer and operational data were later posted when negotiations failed. The group’s leak site remains active and continues to pressure victims with countdown timers and sample file previews.

What to do

• Run a DoxxScan to map every link between your email, phone number, home address, and any handles that may appear in the CreateInfor customer files (cleanup of Warden).
• Rotate any password you have ever used when dealing with CreateInfor.pt or similar repair services, and enable 2FA using an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your data is caught and acted upon within hours rather than months.
• Cover the household — DoxxScan family coverage extends protection to dependents and children’s gaming accounts that often chain back to the same family address or parent email.
• Let remediation specialists handle data-broker takedown requests and opt-out processes on your behalf while you focus on securing accounts.

The incident underscores a growing reality: even small local businesses can become gateways to personal exposure when ransomware groups strike. Acting quickly on the information now available can limit how far attackers chain your data into further harm. Try DoxxScan for the continuous monitoring, identity-chain mapping, and hands-on specialist remediation your family actually needs.