REFSA and PGM appear in ransomware claims

REFSA and PGM were linked to ransomware claims in Argentina during October 2026, but the level of verification was different in each case. For REFSA, HookPhish published an attribution to NightSpire with an incident date of Oct. 31 and a discovery date of Nov. 2, although it did not provide public evidence of compromise or details on the alleged impact. For PGM, the available material points to a news report about incidents and payment demands, still without full official confirmation.

What is known about REFSA?

HookPhish said REFSA was claimed by NightSpire, with the incident dated Oct. 31 and discovery on Nov. 2. However, the post did not include public evidence of compromise or specify which systems may have been affected. For now, what exists is a claim published on a specialized site, not independent confirmation of the attack.

What did local sources say about the other case?

According to Diario Norte, Program Consultores said the incident affected certain servers and denied the theft of confidential information. The same report also said some attackers may have demanded payment in cryptocurrency, though that point was likewise presented as information attributed to unconfirmed sources.

What context does ReliaQuest provide?

ReliaQuest described Qilin as a ransomware-as-a-service operation and The Gentlemen as an affiliate-driven operation. It also documented an increase in manufacturing victims listed on leak sites during the third quarter of 2026, with Qilin rising from 50 to 71 and The Gentlemen from 49 to 74.

Those figures come from leak site listings, not from independent confirmation of compromises. They help frame the activity of those groups during the period, but they do not directly attribute the Argentine cases mentioned in local reporting.

Separately, Diario Norte also placed the incident in a broader context of cyberattacks that reached other provinces, while the material available so far adds no further public confirmation about REFSA or the alleged data extraction.