Leak-site post naming Grupo DT, captured by ThreatCluster

Grupo DT

everest

Ransomware leak-site victim intelligence

Data size
204.28 GB
Files
31,157
Views
8,000
Posted
Aug 20, 2026
Country
ES
Industry
Other

Summary

Written by ThreatCluster from site fields, file listing, victim profile, leak post, screenshot, ransom note

Everest-listed group claims Grupo DT's data repository contains 31,157 files totaling 204.28 GB, with collections including Dpto. Valoraciones, Hierro-Tenecicla, and data on vehicle acquisition, ownership transfer and valuation, plus dealer, towing, scrapyard, waste-management and environmental/regulatory records. The leak page also identifies SEINTO backups totaling 162.95 GB (38 BAK files) and seven PST mailbox files totaling 23.36 GB. Publication status on the leak page is countdown.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
Power BI Access Excel SQL Server OneDrive

What was taken

The Grupo DT data repository contains 31,157 files totaling 204.28 GB. The business data contains 31,119 files totaling 41.33 GB. Dpto. Valoraciones contains 2,843 files totaling 24.00 GB, and Hierro-Tenecicla contains 28,276 files totaling 17.33 GB. The SEINTO SQL Server backup repository contains 38 BAK files totaling 162.95 GB. Dpto. Valoraciones is centered on vehicle acquisition, ownership transfer, valuation, dealer and scrapyard records, payment documentation, identity material and mail archives. Hierro-Tenecicla is centered on waste-management operations, DCS and DI records, SIGAUS files, invoicing, contracts, offers, certificates, banking mandates, environmental documentation and structured SEINTO analytics. The file composition of the business data includes 23,645 PDF files, 4,672 XLS/XLSX spreadsheets, 1,426 DOC/DOCX documents, 1,234 standard image files, 31 PBIX reports, 7 PST mailbox files, 6 MSG files, 2 EML files, 21 PPT/PPTX presentations, one ACCDB database and other operational formats. The data contains records through 2026 together with historical operational, contractual, vehicle, accounting and correspondence material from prior years. The category counts and descriptions below may overlap because the same file can simultaneously belong to a business area, client relationship, vehicle transaction, invoice process, environmental record set, personal-data group and structured reporting model. 1. General Data Coverage 2. Data Sensitivity and Business Content 3. Major Data Areas 3.1 Dpto. Valoraciones 3.2 Hierro-Tenecicla 4. Vehicle Acquisition, Transfer and Valuation Data 5. Dealer, Towing, Scrapyard and Counterparty Records 6. Waste Management, Environmental and Regulatory Data

Data categories
Dpto. ValoracionesHierro-TeneciclaVehicle Acquisition, Transfer and Valuation DataDealer, Towing, Scrapyard and Counterparty RecordsWaste Management, Environmental and Regulatory Data
File types seen
eml × 2msg × 6pdf × 23,645pst × 7pbix × 31image × 1,234doc/docx × 1,426ppt/pptx × 21xls/xlsx × 4,672
Sample files (3)
D:\GDT\Dpto.+Valoraciones.zip > Dpto. Valoraciones\COMPRA-VENTA\1940DBF CAMION MERCEDES\1940DBF FICHA TECNICA.pdf
D:\GDT\Dpto.+Valoraciones.zip > Dpto. Valoraciones\COMPRA-VENTA\CITROEN C3 926-GVK\PERMISO CIRCULACION A NOMBRE DEL TITULAR.pdf
D:\GDT\Dpto.+Valoraciones.zip > Dpto. Valoraciones\COMPRA-VENTA\3434DMZ\CAMBIO TITULARIDAD 3434DMZ_signed_signed.pdf

Ransom note

Published by the group on their leak site, reproduced verbatim.

The files will be published after the timer counts down. The company still has time to get in touch with us

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

SEINTO backups
The SEINTO SQL Server backup repository contains 38 BAK files totaling 162.95 GB.
PST mailbox data
Seven PST mailbox files total 23.36 GB.
Seinto data fields
The SEINTO models contain CIF/CIFNIF, vehicle registration, VIN/chassis, owner and representative identity fields, payment data and receivable information.

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
onion leak page 11 KB
Logo featuring a stylized letter "E" in red and a gray arrow pointing to the right.
onion leak page 6.8 KB
Logo of Kingston Technology featuring a stylized red figure and the company name in black text.
onion leak page 29 KB
Logo featuring the text "GRUPO DT" and "DESGUACES TENERIFE," accompanied by a stylized car outline in orange.
onion leak page 19 KB
Logo of Capgemini featuring a blue stylized cloud shape above the name "Capgemini" with the tagline "Consulting. Technology. Outsourcing."
onion leak page 27 KB
Logo of Atlas Air Worldwide featuring the company name in blue with a yellow globe design above it.
onion leak page 6.7 KB
Logo featuring the text "rx networks" with a stylized design, including a wireless signal icon.
onion leak page 7.3 KB
Logo of Ingersoll Rand featuring the letters "IR" in red with a circular design.
onion leak page 11 KB
Logo of Keysight Technologies featuring a red waveform symbol and the company name in white text.
onion leak page 128 KB
onion leak page 11 KB