On November 06, 2023, GEOCOM Uruguay SA appeared on the leak site operated by the cactus Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack on the company, which provides global IT solutions and certified technology services to customers across multiple sectors. Anyone whose personal or business data passed through GEOCOM’s systems may now be exposed, even though the exact number of affected individuals remains unknown.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Geocom
Get alerted the next time Geocom files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Geocom’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak-Site Listing
The cactus leak site entry states that GEOCOM Uruguay SA suffered a ransomware intrusion and that attackers successfully removed internal files. The disclosure does not quantify the volume of data taken, list specific record counts, or itemize every file type. It simply states that internal files were exfiltrated and gives the victim until a set deadline to negotiate before further publication. Public views of the page show sample screenshots and partial file trees, but full archives have not been released to the open web at the time of this writing. The listing itself serves as the primary disclosure; no separate regulatory filing or customer notification had surfaced when the group posted the victim.
Why This Matters for You and Your Family
When a company like GEOCOM loses control of internal files, the information inside often includes contracts, employee records, customer databases, invoices, and correspondence. If your name, address, national ID, email, phone number, or payment details ever appeared in those systems, the files now held by cactus could contain enough to fuel identity theft or targeted fraud. Ordinary customers and partners of GEOCOM are just as much at risk as the company’s own staff. The uncertainty around the exact data types makes it impossible to dismiss the incident; when the breach volume is unknown, the safest assumption is that any information you entrusted to them could surface later.
The Doxxing and Identity-Chain Risk
Exfiltrated internal files frequently contain spreadsheets that link names to email addresses, phone numbers, customer IDs, and sometimes dates of birth. Attackers and subsequent data resellers can combine these fragments with other leaks to build complete identity chains. A single leaked work email can lead to personal accounts, family member names, and even children’s gaming usernames if the same password habits or recovery details were reused. Once the chain exists, doxxing escalates quickly: harassment, SIM-swapping, or account takeovers become practical. Credential leaks of this nature routinely cascade into gaming platforms, where children’s accounts are prime targets because parental credit cards and home addresses are often attached.