Ransomware: dragonforce claims Petrini Valores (AR) — Financial Services

On 16 July 2026, a ransomware group known as Dragonforce publicly claimed responsibility for a cyberattack against Petrini Valores, an Argentine financial services firm. The claim was published on the ransomware.live data leak site, indicating that the group has exfiltrated data and is threatening to release it unless demands are met. While this is not a regulatory publication, it serves as a critical incident alert under the BREACH framework, which tracks confirmed data compromise events. The attack highlights ongoing ransomware risks targeting financial institutions, particularly those in Latin America.

This incident directly affects Petrini Valores and its clients, but the broader implications extend to any financial services organization operating in regions with evolving cybersecurity regulations. Firms handling sensitive financial data, especially those with cross-border operations, should treat this as a warning that threat actors are actively targeting the sector. Compliance teams in EU-regulated entities should assess whether their third-party risk management programs cover exposure to similar non-EU service providers.

Compliance teams should immediately verify that their incident response plans include procedures for ransomware-related data exfiltration, not just encryption. Review current breach notification timelines under GDPR and local financial regulations to ensure readiness for reporting within 72 hours. Finally, update threat intelligence feeds to monitor for Dragonforce tactics and ensure all critical data backups are offline and tested, as this group is known for targeting backup repositories.