Destello ransomware group claims attack on MAPFRE Brasil
The Destello group says it has attacked MAPFRE Brasil, a financial sector organisation, according to a claim made on 4 November 2026. There is no independent confirmation so far and no details on the scope of the alleged incident.
What happened
On 4 November 2026, the Destello ransomware group listed MAPFRE Brasil among its victims. According to the group itself, the organisation, which operates in Brazil's financial sector, was hit by an attack.
This is only a claim. At the time of writing, there is no confirmation from the company or from independent media. The available information also does not indicate which systems may have been affected, what data the attackers may have obtained, or whether a ransom has been demanded. Orbitaley will keep following the case and update this report if new information emerges.
Who the group is
Destello is the name used by the group behind the claim. At present there is no verified information about its origin, how it operates (for example, whether it runs a ransomware-as-a-service, RaaS, model) or the techniques it uses to gain initial access.
It is worth remembering that ransomware groups sometimes publish exaggerated or inaccurate claims to pressure victims or gain notoriety, so their statements should not be treated as fact.
Why it matters
Financial sector organisations hold personal and financial data about their customers, which makes them frequent targets for extortion. If a data leak were confirmed, customers and partners could be targeted by phishing campaigns exploiting the incident.
What organisations can do
Because Destello's specific techniques are not known, the recommended measures are those that work against most ransomware groups:
- Enforce MFA (multi-factor authentication) on VPNs, remote access, email and privileged accounts.
- Prioritise patching of internet-facing systems such as VPN gateways and firewalls.
- Keep encrypted, offline backups and test restoring them regularly.
- Monitor endpoints with detection and response tools and act on alerts about compromised credentials.
- Train staff to recognise phishing and maintain a rehearsed incident response plan.
- Customers and suppliers of the affected organisation should be wary of unexpected emails or calls referring to the incident.
About the group: Destello
Get the alerts
Relevant vulnerabilities, notable ransomware victims, new groups and the weekly bulletin, as soon as they are published.
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.