Empresa de Transportes Via Pajuçara Ltda. Listed by INC Ransom Ransomware Group

On February 26, 2026, Brazilian bus company Empresa de Transportes Via Pajuçara Ltda. appeared on the leak site of the incransom ransomware group. Public reporting indicates the attackers exfiltrated internal files containing employee names, company email addresses, direct phone numbers, and internal extension details.

Reported Details from Reports

Available reporting from the incransom leak site, tracked by ransomware.live, lists the transportation firm as a victim and shows samples of the stolen data. The exposed information includes administrative contacts such as sac@pajunet.com.br, janaina.felix@pajunet.com.br, bianca.barbosa@pajunet.com.br, adriano.lima@pajunet.com.br, and erica.amanda@pajunet.com.br. Phone numbers published include (11) 94744-7972 along with mobile lines (11) 98717-4485, (11) 97679-6019, and (11) 95967-3480. Internal extensions for supervisors and operational leaders are also visible, including Janaína Félix at ext. 6934, Bianca Barbosa at ext. 6783, Adriano Lima at ext. 6761, and Érica Amanda at ext. 6773.

The number of individuals directly affected remains unknown, but the data clearly identifies real people tied to the company’s daily operations. No customer records appear in the published samples, yet the employee contact details alone create immediate risks for those named and their households.

Why This Matters for You and Your Family

When a company you work for or do business with loses internal contact information, the consequences reach beyond the office. The emails and phone numbers now circulating on dark web leak sites can be used to target you with phishing texts, vishing calls, or spam that feels personal because it references your exact workplace. For many families this means heightened risk of scams aimed at grandparents, partners, or teenagers who share the same phone plan or home address.

Credential leaks like this one frequently cascade into account takeovers. An attacker who obtains a work email and phone number can attempt password resets on personal banking, government, or retail accounts that reuse even part of that data. Children’s gaming accounts linked to family phones or shared addresses become especially vulnerable entry points for further harassment and doxxing.

The Doxxing and Identity-Chain Risks

Once names, emails, and phone numbers are public, attackers can chain them with other breached records to build a full identity profile. A single work phone number can link to your home address through public records or previous leaks. That address can then connect to children’s usernames on gaming platforms, exposing the entire household to swatting, identity theft, or sustained online harassment.

These chains grow quickly. What begins as an employee directory can become a roadmap for criminals to map family relationships, financial details, and online handles. The speed at which this happens leaves most people unaware until damage appears in their bank account, credit report, or child’s gaming profile.

Incransom Group’s Known Activity

Public reporting attributes the incransom ransomware group with operations that emerged in recent years. The group typically gains initial access through common vectors such as phishing or exploited remote desktop services, exfiltrates sensitive files before encrypting systems, and then posts samples on its leak site to pressure victims into payment. Notable prior targets have included various mid-sized companies across different sectors, though specific earlier victims are still being catalogued by ransomware trackers. Their playbook relies on public embarrassment and the threat of full data release rather than immediate mass publication.

What to do

• Run a DoxxScan to map every link between your work emails, phone numbers, family addresses, and online handles across 13.1B+ breach records and 100+ platforms.
• Rotate any passwords used at Via Pajuçara or pajunet.com.br anywhere they are reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts tied to the same contact details.
• Let remediation specialists handle takedown requests for the exposed phone numbers and emails across data broker sites and leak forums.

The incident shows how quickly workplace data becomes personal risk. Acting promptly on the exposed details can limit how far attackers take the information before it reaches your family’s daily life. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage extends to children’s gaming accounts that often serve as the weakest link in these cascading attacks.