Mercado Libre Listed by thegentlemen Ransomware Group

On July 6, 2026, the ransomware group known as thegentlemen added Mercado Libre to its leak site, confirming that internal files had been exfiltrated from the Latin American e-commerce and fintech giant.

Confirmed Facts from Public Reporting

Public reporting indicates that Mercado Libre, founded in 1999 and headquartered in Argentina, suffered a ransomware incident in which attackers extracted internal company files. The platform, which operates the dominant online marketplace across Latin America along with Mercado Pago payments and Mercado Envíos logistics, has not yet disclosed the exact number of records involved or the specific data types contained in the stolen files. Available reporting describes the listing on the group’s leak site but provides no confirmed victim count or detailed inventory of exposed information such as customer names, emails, payment details, or employee records. The incident remains under active extortion pressure typical of ransomware operations.

Why This Matters for You and Your Family

If you or anyone in your household has ever bought or sold on Mercado Libre, used Mercado Pago, or created an account tied to your email, phone number, or home address, your information could be inside the stolen files. Credential leaks from large marketplaces frequently cascade into other services where the same password or personal details are reused. For families this means children’s accounts, shared email addresses, or linked gaming profiles can quickly become targets once one piece of data surfaces. The breach affects ordinary users across Latin America who rely on the platform for daily purchases, bill payments, and small-business activity.

The Doxxing and Identity-Chain Implications

Stolen internal files often contain more than simple passwords. They can include customer databases, support tickets, shipping addresses, and employee contact lists that attackers combine with information from other breaches. This creates identity chains — linked handles, emails, phones, and real-world identities — that enable doxxing, targeted phishing, account takeovers, and eventual extortion. Public reporting on similar incidents shows that once initial data appears on a ransomware leak site, it spreads rapidly across underground forums, increasing the chance that someone will use it against you or your family members.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024 as a ransomware operation that specializes in targeting mid-to-large organizations and then listing stolen data when victims refuse payment. Notable prior victims listed on their leak site have included companies in technology, logistics, and retail sectors. Their typical playbook involves initial access through compromised credentials or phishing, followed by exfiltration of internal documents, and finally public extortion with countdown deadlines on their leak portal. The group’s name appears consistently in ransomware trackers, allowing ongoing monitoring of their activity.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then complete the no-subscription cleanup of exposed data.
• Rotate the password you used on Mercado Libre anywhere it is reused and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails used on marketplaces like Mercado Libre.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles that surface after this incident.

The incident underscores that even large, well-known platforms can become gateways to personal exposure when internal files leave the company’s control. One short forward-looking step can limit the damage: treat every credential leak as the start of a potential chain rather than an isolated event. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts — capabilities that directly address the cascading risks shown in breaches like this one.