A ransomware group calling itself Barracuda has added FINSA, a large Spanish wood-products manufacturer, to its data leak site. The group claims it stole 800 GB of internal files and stopped the company's operations by attacking its virtualization systems. It is offering the data for sale at $100,000. This is the attackers' claim only. FINSA has not commented in public, and no regulator filing or statement from Spain's national CERT has been published. Ransomware leak-site trackers first recorded the listing on the evening of 14 November 2026. None of them has checked the stolen data or confirmed the breach on its own. The group's name is a coincidence: nothing public links it to Barracuda Networks, the security vendor. That vendor is dealing with separate security problems of its own this month.
What Happened
At about 17:50 UTC on 14 November 2026, the leak-site tracker ransomware.live picked up a new post from the Barracuda group naming FINSA. The group's own wording calls the company "a multi-billion-dollar wood processing company." Several aggregators copied the post within hours, including HookPhish, OffSet7, Cyber Security News (securitynews.ch) and the Spanish-language Kalir Pulse, which logged it at 18:13 UTC. Each of them repeats the group's statement. None adds independent reporting. Cyber Security News says outright that it "did not report or verify the underlying story."
The group makes three claims in the post:
- Data theft: that during an "audit" it found "numerous violations in data storage and infrastructure security" and took "all confidential and production files" from FINSA's servers.
- Disruption: that it "completely halted operations by attacking the company's virtualization."
- Extortion: that the data is for sale at $100,000, and that the group will give the files to "the media, competitors, and legal firms" otherwise.
Calling the break-in an "audit" that found compliance failures is a common extortion tactic. It is meant to pressure the victim with the threat of regulators or lawsuits. It tells us nothing about how the attackers actually got in.
Some trackers label the sector wrongly. HookPhish and OffSet7 both list FINSA under "Financial Services." That looks like an automatic tagging mistake: the group's own post, QPulse and Kalir all describe FINSA as a wood-processing or manufacturing company.
No source confirms that FINSA's operations were actually disrupted. That part of the claim is also unverified.
What Was Taken
The group says it took 800 GB of data. Every outlet that has covered the listing gives the same figure, but they are all repeating one claim. No one has given an independent estimate. According to the post, the stolen material includes:
- Internal production information from across FINSA's facilities
- Financial documents, databases and reports
- "Full employee information"
- Materials and technology for processing wood
- Contracts with partners, including their terms
If the claim is true, the employee data would be the most serious part. It would probably include personal data covered by GDPR, and FINSA would then have to report the breach to Spain's data protection authority (AEPD) within 72 hours of becoming aware of it. The production and technology files are commercially valuable intellectual property. The partner contracts would put suppliers and customers at risk of follow-up fraud, such as invoice redirection or impersonating FINSA. No samples have been independently examined, so it is not yet known whether the data is real, how much there is, or how new it is.
Why It Matters
- Attacks on virtualization have become standard. Many groups now encrypt or disable hypervisors (ESXi, Hyper-V, Proxmox) because one attack can take down every virtual machine running on them. If the group's claim is true, it fits that pattern.
- Theft and disruption together. Selling stolen data while also stopping production gives the attackers two ways to pressure the victim. A manufacturer that loses production days pays a cost on top of the data exposure.
- Risk to suppliers and partners. FINSA works with many companies in construction, furniture and timber. Those partners should expect phishing and payment fraud that uses details from the allegedly stolen contracts.
- Do not confuse the group with the vendor. In the same month, Barracuda Networks disclosed two Barracuda appliance vulnerabilities being exploited in attacks, which SecurityWeek covered, plus a separate intrusion into the company's own cloud environment. Nothing public connects the ransomware group to the company, and nothing suggests FINSA was attacked through Barracuda products. Defenders should not merge these into one story.
The Attack Technique
How the attackers got in is not known. Neither the group nor FINSA has said, and no technical indicators for this incident have been published. The only technical claim is that the group attacked the company's virtualization layer to stop operations.
Two related Barracuda Networks issues are in the news this month. Neither is linked to FINSA:
- Appliance vulnerabilities: SecurityWeek reports that Barracuda Networks patched CVE-2026-116606, an authentication bypass in Email Security Gateway rated CVSS 9.3, and CVE-2026-111560, a command injection flaw rated CVSS 8.6 that affects ESG, Load Balancer ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center. Used together, the two flaws give an attacker root access. Barracuda Networks updated its advisory to say they had been exploited against "a small number of organizations." CISA added both to its Known Exploited Vulnerabilities catalog. The security firm Previdian says it saw 17 exploitation attempts from 15 IP addresses between 9 and 11 November.
- Vendor cloud intrusion: Barracuda Networks says an attacker used a cloud access key the company had left active after a third-party AI vendor finished its work. The key had been exposed when that vendor's development environment was breached in October. The company's write-up says the attacker reached about 10 cloud accounts in roughly 44 hours between 1 and 2 November. It moved from cloud secrets to a data analytics system, then to a source-code token, then to Kubernetes clusters. Barracuda Networks says the naming patterns the attacker used match ARTEX, an open-source AI-driven penetration-testing tool. Customers who were notified are told to revoke and recreate their integration credentials and to review activity from 1 November onward.
We mention these only to rule them out. If you use Barracuda products, apply the patches anyway. They do not explain the FINSA claim.
What Organizations Should Do
- Harden hypervisors and their management tools. Keep ESXi, vCenter and Hyper-V management off the general corporate network. Require MFA for admin access. Do not join hypervisor hosts to the main Active Directory domain. Patch management interfaces quickly.
- Keep backups attackers cannot reach. Store backups offline or in immutable storage, with separate credentials. Run test restores of whole virtual environments, not just individual files.
- Watch for large data transfers out of the network. Moving 800 GB out takes time. Alert on unusual outbound volume, rclone or MEGA traffic, and new cloud storage connections from servers.
- FINSA's partners and suppliers: expect fraud. Confirm any change to bank details or contracts through a known phone number. Warn finance staff about invoice redirection that cites real contract terms.
- Retire unused third-party credentials. The Barracuda Networks intrusion is an unrelated example of how an access key left active after a vendor project ends becomes a way in. Review and revoke these keys on a schedule.
- Patch Barracuda appliances against CVE-2026-116606 and CVE-2026-111560 if you run them, and make sure their admin interfaces cannot be reached from the internet.
Sources: Barracuda Ransomware Group Claims Attack on FINSA, Exfiltrating 800... | Recently Patched Barracuda Vulnerabilities Exploited in Attacks - S... | Barracuda XDR Integration Credentials Barracuda Networks | Forty-four hours: Anatomy of a machine-speed intrusion Barracuda... | FINSA Data Breach: Barracuda Ransomware Claim (Nov 2026) | 🏴☠️ Barracuda has just published a new victim : FINSA | FINSA listed by barracuda ransomware group OffSet7 | Ransomware Barracuda publica a la maderera española FINSA · Kalir B...