Skip to content
Leak-site post naming Gerencial, captured by ThreatCluster

Gerencial

spacebears

Ransomware leak-site victim intelligence · PT

Views
19,930
Posted
Jun 17, 2026
Countdown
0 day 0 hour 0 minute
Country
Brazil
Industry
accounting & advisory

Summary

Written by ThreatClusterfrom victim profile, leak post

Spacebears claims they obtained and published personal digital certificates (about 1,000) (.pfx/.p12 files) and the passwords for accessing Brazilian official government websites from Gerencial Contábil. They claim to have 600,000+ files containing personal information, including client data such as telephone numbers, emails, IDs, and passwords. The leak page identifies the victim as Gerencial Contábil (Gerencial PR), a Brazilian accounting firm in Paraná, with the domain gerencialcontabil.com.br, and states the publication status as published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
gerencialcontabil.com.br

What was taken

Gerencial Contábil (Gerencial PR) is a Brazilian accounting and business advisory firm based in the state of Paraná. The company provides accounting, tax, payroll, business consulting, and HR outsourcing services for small and medium-sized businesses. It also assists entrepreneurs with company formation, tax compliance, and business management. The firm operates through multiple offices across Paraná, including locations in Pato Branco, Francisco Beltrão, Dois Vizinhos, Cascavel, Guarapuava, and other cities. Its services are tailored to sectors such as commerce, industry, service providers, and non-profit organizations. -personal digital certificates (amount ~ 1 000) (.pfx / .p12 files) and the corresponding passwords for accessing the Brazilian official government websites. -Clients info (tel, mail, id, passwords, etc) -600 000 + files with personal information

Data categories
Clients infoPersonal information
Leak site tags
BrazilAccountingParaná

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo featuring the text "GerencialPR" with a caduceus symbol, accompanied by the phrase "ESCRITÓRIO CONTÁBIL & ASSESSORIA EMPRESARIAL."
onion leak page24 KB