Skip to content
Leak-site post naming Italtel Peru, captured by ThreatCluster

Italtel Peru

everest

Ransomware leak-site victim intelligence · EN

Data size
388.996 GB
Files
2,778,353
Views
37,000
Posted
Sep 1, 2026
Country
PE
Industry
The repository reflects the work of a systems integrator delivering enterprise networking, wireless connectivity, data-c

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot, ransom note

Italtel Peru’s data repository is claimed by the Everest group to comprise 388.996 GB across 2,778,353 files. The leak page describes the contents as project, commercial, legal, engineering and operational records related to public institutions, banks, utilities, retailers and telecommunications providers, among others. The threat actor states the files will be published after a countdown; the leak post lists the publication status as published with a timer indicating additional material to come. Victim is identified as Italtel Peru (domain italtel.com); sector listed as systems integrator / IT services, with high-sensitivity areas including internal access records.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
KeePass OpenVPN VMware NSX Palo Alto Alteon F5

What was taken

The Italtel Peru data repository contains project, commercial, legal, engineering and operational records relating to public institutions, banks, financial companies, utilities, retailers, telecommunications providers, airports, hospitality projects and internal Italtel systems.

Data categories
Accounting / financeTax / fiscalLegal / corporateHR / payroll / employmentBanking / treasury / financingAudit / complianceLitigation / disputesIdentity / personal documentsAccess / credential-relatedDatabases / backupsCorrespondence / mail
Leak site tags
italtel-peruenterprise networkingsystems integrator
File types seen
db × 516bak × 257cer × 26crt × 189csv × 1,868dbf × 113doc × 102dwg × 3,835eml × 6jpg × 11,167log × 3,851mov × 3mp4 × 459msg × 934p12 × 8pdf × 15,103pem × 1,004pfx × 11png × 85,260ppk × 5sql × 1,540txt × 35,389xls × 68xml × 21,907docx × 7,870kdbx × 2ovpn × 3pptx × 478vsdx × 2,405xlsm × 211xlsx × 7,799config × 3,986sqlite × 13
Sample files (3)
Estructura de costos_updt.xlsx
Formato Economico CGR 18Nov2022.xlsx
CGR Costos Huawei.xlsx

Ransom note

Published by the group on their leak site, reproduced verbatim.

The files will be published after the timer counts down. The company still has time to get in touch with us

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

countdown_notice
The files will be published after the timer counts down. The company still has time to get in touch with us

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
onion leak page11 KB
The image features the logo of Italtel, consisting of a stylized triangular design in blue, green, and yellow, alongside the company name in black text.
onion leak page16 KB
Logo of VIVOTEK, featuring the brand name in blue with a stylized camera icon.
onion leak page16 KB
onion leak page1.5 KB
Logo of Keysight Technologies featuring a red waveform graphic and the company name in white text.
onion leak page128 KB
Logo of CCA Bank featuring a purple octagonal design with the text "CCA Bank" and a tagline in French.
onion leak page7.5 KB
Logo featuring a stylized letter "E" in red and a gray arrow pointing to the right.
onion leak page6.8 KB
Logo featuring the text "GRUPO DT" and "DESGUACES TENERIFE," accompanied by a stylized car outline in orange.
onion leak page19 KB
Logo of Capgemini featuring a blue spade symbol and the text "Capgemini" with the tagline "Consulting. Technology. Outsourcing."
onion leak page27 KB
Logo of Atlas Air Worldwide featuring the company name in blue with a yellow globe design above it.
onion leak page6.7 KB