Brazil: Global Secret Group in ransomware case

Brazil and a case attributed to Global Secret Group

The ransomware.live threat intelligence project identified Global Secret Group as the actor behind a ransomware incident targeting a Hospitals & Clinics organization in Brazil, discovered on July 26, 2026. The entry appears in the Brazil victim map published by the platform and adds to the activity that different tracking dashboards have been recording across the region.

The regional context

The record appears alongside data ESET released for the first half of 2026. According to that report, ransomware attacks increased 16.5% globally and reached 4,699 confirmed incidents. The company highlighted Qilin, The Gentlemen and Akira as the most active groups, accounting for 33.5% of all attacks, and said their main targets were business services, manufacturing and technology.

In Latin America, ESET said Brazil surpassed 100 victims, Mexico reached nearly 80, Argentina 39 and Colombia 33. In Chile, Qilin recorded a peak of 19 detections in January.

The most exposed sectors

The data shared by ransomware.live and by the report cited by ITSitio points to sustained pressure on critical, highly exposed sectors. In the Brazilian case, the incident linked to Global Secret Group affected the health sector, while ESET's regional report placed business services, manufacturing and technology among the most frequent targets.

The available material also points to victim dashboards for Brazil, Argentina, Chile and Mexico within ransomware.live, along with sector-specific reports and monitoring for the region. Taken together, those sources show Brazil as one of the hardest-hit countries, followed by Mexico, Argentina and Colombia in ESET's confirmed victim count for the half-year.