The Destello ransomware group has listed MAPFRE Brasil, the Brazilian arm of the Spanish insurer MAPFRE, on its dark web leak site. The group says it has "indexed and archived" 127,874,330 records, including Brazilian national ID numbers, policy data, claims histories and details of the company's internal Active Directory setup. Nothing about the claim has been verified. MAPFRE Brasil has not commented publicly, no regulator filing has been published, and no established security outlet has confirmed an intrusion. Everything known so far comes from the group's own listing, as passed on by ransomware trackers and threat-intel feeds.
What Happened
Between November 4 and 5, 2026, Destello added an entry titled "MAPFRE Brasil 2026" to its leak site. Trackers disagree on when it appeared. Orbitaley and a Dark Web Intelligence feed cited by Undercode News date the listing to November 4. ThreatMon, Ransomware.live and HookPhish give November 5, with HookPhish recording discovery at 06:18 UTC that day.
The listing shows a deadline of November 3, 2026 at 16:40 UTC. QPulse treats that as the estimated attack date, and HookPhish records it as the "date of breach." It reads more like an expired ransom deadline. Undercode News reports that the group says its deadline has passed and that it has started publishing data. Ransomware.live marks the listing as "PUBLISHED," and the group links to a proof file on its onion site.
Accounts differ on how much has actually been released. Undercode News says about 10% of the claimed dataset has been staged for publication. Persian Security describes the full 127 million records as now available. No outlet reports having downloaded or examined the data.
Little is known about Destello. QPulse calls it an emerging group and says its claims should be treated with caution until someone verifies them independently. Orbitaley says there is no verified information about where the group comes from, whether it runs a ransomware-as-a-service model, or how it gets into networks.
What Was Taken
Everything below is what the attackers say they took. None of it has been confirmed.
Volume. QPulse and Undercode News both report a claimed 9 GB. Undercode News adds a figure of about 735 files. The record count of 127,874,330 appears in the group's listing as reproduced by Ransomware.live, HookPhish and QPulse.
These figures deserve scrutiny. Brazil has about 213 million people, so 127 million records would cover more than half the country. That is possible for a large insurer if the records include duplicates, policy-level rows or historical data, but extortion groups often inflate their numbers. Squeezing 127 million records into 9 GB would also mean records averaging roughly 70 bytes each. That works for compact flat tables but not for document-heavy files.
Personal data the group lists: - Full CPF numbers (Brazil's taxpayer ID) - RG numbers (state ID card) with the issuing agency - Dates of birth and gender - Addresses with CEP postal codes - Real email addresses and mobile phone numbers
Insurance data: - Policy numbers - Insurance claims history
Internal infrastructure the group lists: - Corporate directory - Active Directory structure, which the group says covers 20 domain controllers, 40 SCCM endpoints and 2 ADCS certificate authorities - What looks like a reference to backups. The listing is cut off mid-word ("backup ca..."), and Persian Security reads it as access to the organisation's backups.
Why It Matters
If the personal data is real, it is enough for fraud. In Brazil, a CPF plus RG, date of birth and address is the core set of details used to open accounts, take out credit and pass identity checks. Add policy numbers and claims history, and criminals can send very convincing fake insurer messages: "your claim needs a document," "your policy renewal failed." Orbitaley warns that customers and partners could be hit with phishing that uses the incident as cover.
The infrastructure claims are more worrying for defenders. Naming 20 domain controllers, 40 SCCM endpoints and 2 ADCS certificate authorities implies very deep access. SCCM can push software to every managed machine. A compromised ADCS certificate authority can issue certificates that authenticate as any user, and those certificates stay valid after passwords are reset. If even part of this is true, cleaning up means more than restoring files. It could involve rebuilding trust in the company's identity infrastructure. QPulse notes that this level of visibility could support further lateral movement or long-term access.
Exposure under Brazilian law. A confirmed breach of this size would bring obligations under Brazil's data protection law (LGPD), including notifying the national data protection authority (ANPD). It would also draw attention from the insurance regulator, SUSEP. No filing or notice from either body has appeared.
There is a real chance the claim is false. Orbitaley and Undercode News both point out that ransomware groups sometimes exaggerate or invent claims to pressure victims or build a reputation. That risk is higher for a new group with no track record. Its listings may also recycle data from older, unrelated leaks. Undercode News notes that MAPFRE Brasil has not confirmed any new incident linked to this claim.
The Attack Technique
How Destello got in, if it did, is unknown. None of the reports describe an initial access vector, exploited vulnerability, credential source or ransom amount. Nobody has reported whether files were encrypted or whether MAPFRE Brasil's operations have been disrupted.
The only technical details are the group's own claims about Active Directory, SCCM and ADCS. If those are accurate, they point to a familiar sequence:
- Initial foothold
- Privilege escalation to domain-level control
- Abuse of management and certificate infrastructure to gain wide reach and persistence
- Bulk export of data, probably from policy and claims databases or their backups
This is a guess based on what the group says it reached. No forensic finding supports it.
What Organizations Should Do
- Audit ADCS now. Review certificate templates for known misconfiguration classes such as ESC1 to ESC8. Turn off enrollment agent and SAN-override settings that you don't need. Monitor for unusual certificate issuance. If you suspect a compromise, plan to revoke certificates and rebuild the CA. Resetting passwords alone does not fix it.
- Lock down SCCM. Restrict and monitor accounts with SCCM admin rights, remove network access accounts with too many privileges, and alert on new deployments, packages or scripts pushed outside change windows.
- Watch domain controllers and backups. Alert on DCSync, NTDS.dit access, new domain admins and unusual Kerberos activity. Keep at least one copy of your backups offline or immutable, and test that you can restore it.
- Detect bulk data exports. Set baselines for normal query and export volumes on policy and claims databases, and alert on large or out-of-hours reads and outbound transfers.
- Enforce phishing-resistant MFA on VPNs, remote access, email and every privileged account. Prioritise patching internet-facing edge devices.
- Brazilian insurers, brokers and partners: tell customers and staff to expect phishing that mentions MAPFRE policies or claims. Add extra checks to claim-payment and bank-detail-change workflows, and watch for fraud attempts that use CPF and policy data.
Sources: Destello Ransomware Group Claims Exfiltration of 127 Million Record... | Destello ransomware group claims attack on MAPFRE Brasil · Orbitaley | Destello Claims MAPFRE Brasil as Its Latest Ransomware Victim in Br... | Destello Claims Data Theft From MAPFRE Brasil, Alleging 9GB Insuran... | MAPFRE Brasil 2026 Data Breach: Destello Ransomware Claim (Nov 2026) | نشت گسترده دادههای شرکت بیمه MAPFRE Brasil توسط گروه Destello – Pe... | 🏴☠️ Destello has just published a new victim : MAPFRE Brasil 2026 | SecPulse