F************.pe Listed by Cloak Ransomware Group

On November 16, 2024, the Peruvian company F************.pe appeared on the leak site operated by the cloak Ransomware Group, which publicly listed 221GB of the organization’s internal files as exfiltrated during a ransomware attack.

Details in the Leak Listing

The cloak leak site states that F************.pe, a private entity based in Peru, was hit in a ransomware operation and that attackers successfully removed 221GB of internal files. The disclosure does not specify the exact data types contained in the archive, the number of individuals whose records may have been exposed, or any ransom demand. It simply states that exfiltration occurred and that the data is now hosted for anyone who accesses the group’s onion site. Public trackers such as ransomware.live mirror the listing, preserving the original claim that the files were taken during the intrusion.

Why This Matters for You and Your Family

When a company that handles everyday business, employment, or service records is breached, the information inside those 221GB of files can easily include names, addresses, national identification numbers, contact details, or financial transactions tied to ordinary customers and employees. Even though the exact contents remain undisclosed, the mere fact that internal files were taken and published creates immediate risk for anyone whose data touched that organization. You and your family could face sudden spikes in phishing, identity theft attempts, or unwanted solicitations once opportunistic actors download and scan the archive. The breach also signals that the company’s internal security perimeter was breached, raising the chance that related vendors or partners were affected in the same campaign.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain spreadsheets, email exports, or customer databases that link personal identifiers to usernames, phone numbers, or even passwords. Once those links surface on a ransomware leak site, other criminals can chain them with data from previous breaches to build complete identity profiles. A single leaked work email can reveal your home address through public records, while an exposed phone number can unlock SIM-swapping attacks or account takeovers on personal services. Credential leaks like this one often cascade into gaming platforms, where children’s accounts become entry points for further harassment or doxxing because the same password or recovery email is reused. The longer the data sits on the cloak site, the more likely it is that multiple threat actors have already copied and begun exploiting it.

Cloak Ransomware Group’s Known Track Record

Public reporting attributes the cloak Ransomware Group with emerging in mid-2024 and focusing on double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data for later publication if ransom is not paid. The group maintains its own leak site on the Tor network and has listed companies across several continents, typically targeting mid-sized organizations in healthcare, manufacturing, and professional services. Their playbook usually involves initial access through phishing or exploited remote desktop services, followed by lateral movement to locate valuable file shares, then exfiltration before detonation of the ransomware payload. The group’s public statements emphasize timely publication of stolen data when victims refuse to negotiate, a pattern consistent with the November 16 listing of F************.pe.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to this claimed breach.
• Rotate any password you ever used at F************.pe or related Peruvian services, then enable 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and acted on in hours rather than months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests for any personal records that surface from this or linked data brokers.

The appearance of another Latin American company on a ransomware leak site reminds us that these incidents are now routine and that the data taken today can fuel identity crimes for years. Starting with a clear picture of your own exposure is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that frequently sit at the center of cascading attacks.