Skip to content
CTI Academy Sponsor CTI Academy
PE

Ransomware attacks in Peru

87 organisations in Peru have been listed on ransomware leak sites, ranking #34 worldwide. Updated .

Victims
87
0.4% of global total
Global rank
#34
of 180 countries
Active groups
35
Most: Qilin
Sectors
19
Most: Agriculture and Food Production

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Peru. Figures are computed from the tracked records, not inferred.

Peru's threat landscape shows 87 recorded ransomware victims; globally ranked 34, with Qilin, Thegentlemen, Safepay active across Agriculture and Food Production, Public Sector, and Manufacturing sectors.

Peru in the global picture

Peru accounts for 87 of the ransomware disclosures tracked here, ranking #34 worldwide and making up 0.4% of the global total. The sectors listed most often are Agriculture and Food Production, Public Sector, Manufacturing.

Who is most active in Peru

Qilin — 13 victims in Peru. Qilin ransomware was first observed in July of 2022. Thegentlemen — 9 victims in Peru. Safepay — 5 victims in Peru.

Ransomware threat profile: Peru

Peru ranks #34 worldwide for ransomware disclosures, with 87 victims in this database — 0.4% of the global total. The groups listing the most organisations here are Qilin, Thegentlemen and Safepay.

The most frequently listed industries in Peru are Agriculture and Food Production, Public Sector, Manufacturing. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Peru's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Peru 87

Organization Disclosed
Belcorp
Qilin
Interseguro
Direwolf
TQC S.A.
Dragonforce
Hospital Hermilio Valdizán
Ransomhouse
AGROFRUTO SAC
Arcusmedia
Gelarti
Thegentlemen
Gelarti
Thegentlemen
gob.pe
Safepay
gob.pe
Safepay
Honda (Peru)
Panzer
Honda (Peru)
Panzer
Comin Sac
Thegentlemen
Comin Sac
Thegentlemen
Italtel Peru
Everest
Italtel Peru
Everest
Global Go
Killsec
Movitecnica
Qilin
WATERLANDPE.COM
Clop
Grupo Diestra
Qilin
www.hymiasa.com
Krybit
Municipalidad de San Luis
Thegentlemen
Upanal CNC Solutions
Thegentlemen
Triton Trading
Qilin
Marpatech
Nova
Famesa
Qilin
Famesa
Qilin
sansilvestre.edu.pe
Krybit
transvill.com.pe
Nova
Corporación Primax S.A.
Aurora
Sunass
Nova
shougang.com.pe
Lockbit5
Desysweb
Nova
Diviso Grupo Financiero
Thegentlemen
corahperu.org
Apt73
protectasecurity.pe
Apt73
Peru LNG (Hunt LNG Operating Company)
Coinbasecartel
comunidadandina.org
Lockbit5
Grupo Tawa
Thegentlemen
Grupo Coril
Qilin
Grupo San Jacinto
Thegentlemen
Verlat Energy
Vect
Alpha Consult
Qilin
San Silvestre School
Qilin
National Water Authority
Blackshrantac
surfishtrade.com
Lockbit5
Agrícola Cerro Prieto
Blackshrantac
Egp Comunicaciones Sac
Qilin
Don Ricardo
Qilin
Superintendencia Nacional de Fiscalización Laboral
Blackshrantac
Carvimsa
Blackshrantac
Instituto Nacional de Oftalmologia, Peru
Nightspire
MC INVERSIONES INMOBILIARIAS Construction company in Peru
Radar
Suiza Lab
Killsec
www.primax.com
Lynx
BDO Perú
Incransom
bisa.com.pe
Safepay
Machu Picchu Foods
Sarcoma
Medifarma
Direwolf
Hospital José Agurto Tello de Chosica
Nightspire
kolpa.com.pe
Safepay
Government of Peru
Rhysida
Machu PicchuFoods
Akira
Machu Picchu Foods
Akira
movistar.com.pe
Babuk2
jockeysalud.com.pe
Safepay
peruzzi.com
Qilin
Chimu Agropecuaria S.A.
Akira
Comercializadora S&E Perú
Anubis
Perú Controls S.A.C.
Eldorado
Fmp.gob.pe
Cloak
Chema Per
Sarcoma
F************.pe
Cloak
www.protectasecurity.pe
Apt73
apoyoconsultoria.com
Ransomhub
www.olanocorp.com
Ransomhub
World Vision Perú
Medusa
South American Tours
Meow
clinicatezza.com.pe
Lockbit3
infotexim.pe
Ransomhub
pomalca.com.pe
Qilin
Explomin
Akira
AJE
Medusa
hpo.pe
Lockbit3
Ministry of Defense of Peru
Ransomexx
Ejército del Per
Incransom
CNPC Peru S.A.
Rhysida
derrama.org.pe
Lockbit3

Frequently asked questions

How many ransomware attacks have occurred in Peru?

Peru has recorded 87 ransomware victim disclosures in this database, ranking #34 globally. This represents 0.4% of all tracked ransomware attacks worldwide.

Which ransomware groups target Peru?

The ransomware groups most active in Peru are Qilin, Thegentlemen, Safepay, Nova. These groups collectively account for the majority of victim disclosures attributed to Peru.

Which industries are most targeted by ransomware in Peru?

In Peru, the most frequently targeted sectors are Agriculture and Food Production, Public Sector, Manufacturing. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Peru rank globally for ransomware attacks?

Peru ranks #34 globally for ransomware attacks with 87 victim disclosures, representing 0.4% of the worldwide total of 23,590 tracked victims.

How can organisations in Peru protect against ransomware?

Organisations in Peru should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Peru is also recommended.