RegistroCiberVE
All incidents
unconfirmed actor claim Claim date: Date confidence: High

Presunta extorsión de ALPHV/BlackCat contra C.A. de Seguros La Occidental

La presunta extorsión contra la aseguradora venezolana C.A. de Seguros La Occidental figura en un reclamo de ALPHV/BlackCat publicado el 21 de abril de 2023. Una captura extensa del sitio atribuido al actor y cuatro secciones reproducidas por otro monitor conservan el contenido; allí se alegaba robo de datos y se mostraban 27 capturas aparentes, entre ellas identificaciones, recibos bancarios, documentos de seguros y hojas de cálculo. Una publicación que observó el listado informó que no halló un aviso de la aseguradora ni recibió respuesta a consultas del 21 y 25 de abril. Las capturas acreditan el contenido del reclamo público, pero no autentican los documentos ni confirman acceso, ejecución de ransomware, cifrado, exfiltración, publicación del conjunto, interrupción, personas afectadas o pérdidas.

Overview

Missing evidence

declaración o notificación de C.A. de Seguros La Occidentalevidencia forense de acceso, cifrado o exfiltracióncorpus autenticado, hashes y cadena de custodia de las muestrasfecha y vector de compromisoalcance, personas afectadas, interrupción, demanda y resultado de la extorsión

Impact details

ALPHV alegó robo de datos y mostró 27 capturas aparentes. Las capturas preservadas muestran aparentemente identificaciones, recibos bancarios, documentos de seguros y hojas de cálculo; no existe corpus autenticado, hashes, cadena de custodia o confirmación de la víctima. La disponibilidad operacional permanece desconocida; no equivale a continuidad normal confirmada.

presuntos documentos de segurospresuntas identificaciones personalespresuntos documentos financieros y recibos bancariospresuntas hojas de cálculo y registros empresariales

Classification & severity

Category
Undetermined
Subtype
unconfirmed actor claim
Confidence
Medium

Las fuentes y capturas confirman un reclamo público de ALPHV con muestras aparentes, pero no autentican los documentos ni demuestran acceso, cifrado, exfiltración o ejecución de ransomware.

Severity assessment

Medium
Information impact
Suspected
Affected scope
Organization-wide
Critical service
None
Public confidence
Limited

Reclamo de extorsión contra una aseguradora y 27 capturas aparentes de documentos, sin autenticación, confirmación de intrusión, personas afectadas, interrupción o pérdidas.

Data exfiltration· Claimed

Timeline

Claim

ALPHV/BlackCat publicó un reclamo que nombraba a C.A. de Seguros La Occidental y mostraba 27 capturas aparentes; no se autenticaron los documentos ni el acceso subyacente.

Evidence & sources

5 sources

Registro duplicado de la página de Ransomware.live sobre La Occidental (procedencia heredada de Hackmanac)

Ransomware.live; legacy metadata labeled Hackmanac Apr 21, 2023
Context Security research Source confidence: Low

What this source supports

  • the exact URL duplicates evidence AtVec7wQk1ds-xNgdCvKs
  • the preserved actor-page capture visibly names C.A. de Seguros La Occidental and displays 21 April 2023
  • the capture visibly presents alleged document samples

Evidence limits

Duplicate/misattributed provenance row retained for audit continuity. The capture is evidence of the actor claim only and does not authenticate the apparent documents.

Relevance to this case

Preserves the legacy Hackmanac provenance mismatch without counting the identical URL as independent corroboration.

ALPHV agregó a C.A. de Seguros La Occidental a su lista de víctimas

FalconFeeds.io (@FalconFeedsio) Apr 21, 2023
Primary Social media Source confidence: Medium

What this source supports

  • FalconFeeds.io reported that ALPHV added C.A. de Seguros La Occidental and laoccidental.com to its victim list
  • the visible post repeats actor claims concerning insurance, personal, financial, contract, database and customer data
  • the four images reproduce the ALPHV listing, alleged categories, threat and 27-attachment summary

Evidence limits

Security-feed reproduction of an actor claim. Neither the post nor its images authenticate the alleged files or establish execution of ransomware or exfiltration.

Relevance to this case

Direct accessible provenance for the 21 April ALPHV claim, victim domain and categories asserted by the actor.

CA de Seguros La Occidental Data Breach Report

BreachSense Apr 24, 2023
Corroborating Security research Source confidence: Medium

What this source supports

  • BreachSense lists laoccidental.com as claimed by ALPHV
  • the tracker discovery date is 24 April 2023
  • the dedicated page reports leak size as unknown

Evidence limits

Secondary tracker derived from actor/leak-site monitoring. Its later credential statistics concern external breaches and combo lists and do not evidence this incident.

Relevance to this case

Corroborates the public victim/domain/actor listing and later discovery date only.

Ransomware.live — La Occidental reclamada por ALPHV

Ransomware.live Jul 26, 2023
Primary Security research Source confidence: Medium

What this source supports

  • Ransomware.live identifies La Occidental as claimed by ALPHV and separately displays the actor-page date 21 April 2023
  • the preserved screenshot shows 27 apparent sample images including identification, insurance, bank-receipt and spreadsheet material
  • Ransomware.live states it indexes public operator material and does not hold the underlying content

Evidence limits

Preserved actor-site screenshot establishes the public claim and visible apparent samples, not authenticity, source, chain of custody, completeness or a technical compromise.

Relevance to this case

Strongest accessible direct preservation of what ALPHV publicly claimed and displayed.

Bits ’n Pieces (Trozos y Piezas) #37

DataBreaches.Net May 1, 2023
Corroborating Media report Source confidence: Medium

What this source supports

  • DataBreaches reported that La Occidental was added to the BlackCat leak site on 21 April
  • the author observed 27 screenshots including insurance documents and identification cards
  • DataBreaches found no victim notice and received no response to emails sent on 21 and 25 April

Evidence limits

Independent editorial observation of the actor page and unsuccessful victim outreach; it does not authenticate samples or confirm the underlying intrusion.

Relevance to this case

Useful independent observation of the listing, screenshot count and absence of victim confirmation.