BAM.COM.GT Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 11, 2023, BAM.COM.GT — identified in reporting as Banco Agromercantil de Guatemala, S.A., or BAM — was listed by the clop ransomware group. Public detail indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and broader technical specifics have not been disclosed.

For a financial institution, any confirmed or claimed exposure of internal material raises practical concerns for customers, employees, and counterparties. What follows summarises only what has been reported, places the listing in the context of the named threat actor, and outlines concrete steps people can take while official confirmation stays limited.

Breaking down the breach

According to the available record, BAM.COM.GT appeared on a clop-associated listing dated July 11, 2023. The organisation is described as Banco Agromercantil de Guatemala, S.A. - BAM. The sole characterisation of the incident is that internal files were allegedly exfiltrated in a ransomware attack. No figure for affected individuals has been published, no attack vector or initial access method has been detailed in the provided facts, and no timeline of compromise, discovery, or containment has been released publicly in this record.

Because the listing originates with the threat actor, it constitutes a claim rather than independent verification. Organisations named on such sites sometimes confirm incidents later; sometimes they do not. At present the public facts stop at the listing itself and the description of internal-file exfiltration. Scale, precise file inventories, and any ransom demand or payment status are undisclosed.

Inside clop

Clop (also styled CL0P) is a long-running ransomware operation that has conducted double-extortion campaigns for several years. The group typically encrypts systems while also copying data, then pressures victims by threatening to publish the stolen material on a dedicated leak site if payment is not made. Clop has repeatedly exploited widely used enterprise software vulnerabilities and has targeted large organisations across finance, manufacturing, education, and government supply chains. Its operators have been linked to high-volume campaigns, including those that abused file-transfer products, and law-enforcement agencies in multiple countries have publicly attributed numerous incidents to the group or its affiliates.

In keeping with that pattern, a leak-site listing is the group’s standard method of asserting that it holds a victim’s data. For this specific case the facts state only that BAM.COM.GT was listed and that internal files were described as exfiltrated; no further statements attributed to clop about this victim appear in the record. Readers should therefore treat the claim as unverified until corroborated by the organisation or independent investigators.

Who is BAM.COM.GT?

BAM.COM.GT is the online presence of Banco Agromercantil de Guatemala, S.A., a commercial bank operating in Guatemala. Banks of this type hold customer account records, transaction histories, identity and contact data, credit and loan files, employee information, and internal operational documents. They also maintain relationships with regulators, correspondent banks, and payment networks.

A breach claim against any bank is consequential because the institution sits at the centre of individuals’ and businesses’ financial lives. Even limited internal-file exposure can create secondary risks—fraud attempts, social-engineering campaigns that reference real account details, or regulatory scrutiny—regardless of whether customer-facing systems themselves were encrypted or taken offline. Public detail on the precise scope of this incident remains limited, so the consequences stay potential rather than fully mapped.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of file types, no confirmation of customer databases, and no statement about credentials, financial statements, or personally identifiable information appear in the record. Exact contents are therefore unconfirmed.

Organisations in the banking sector typically retain large volumes of sensitive data: government-issued identification numbers, addresses, account numbers, transaction logs, credit assessments, employee payroll and HR files, internal policies, and vendor contracts. Any of these categories could in principle be present among “internal files,” yet it would be inaccurate to assert that specific categories were taken. Until BAM or independent analysis publishes a verified list, the public position is simply that internal material was claimed to have been copied and that the precise composition is unknown.

The real-world impact

For individuals, the primary near-term risks are opportunistic fraud and social engineering. If internal documents contain customer or employee details, criminals unaffiliated with the original actors may later attempt phishing, impersonation, or account-takeover schemes that reference plausible personal or account information. Credit monitoring and careful verification of any unexpected banking contact become prudent. For the bank itself, consequences can include forensic and recovery costs, possible regulatory notification duties under Guatemalan and international financial rules, reputational damage, and the operational burden of determining exactly what left the network.

Because the number of people affected is listed as unknown and no confirmed data types beyond “internal files” have been supplied, it is not possible to quantify exposure. The impact remains real in the sense that any exfiltrated banking-related material can be misused over months or years, yet it is bounded by the absence of verified detail. Neither negligence on the part of the institution nor successful encryption of production systems should be assumed from the listing alone.

If your data was in this claimed breach

If you hold accounts or have other relationships with Banco Agromercantil de Guatemala, treat the situation as a prompt for heightened caution rather than confirmed personal compromise. Practical first steps include:

• Monitor account statements and credit reports for unfamiliar activity and enable any available transaction alerts.
• Be sceptical of unsolicited calls, emails, or messages that reference the bank or this incident; verify through official channels you already trust.
• Change online-banking and email passwords if you reuse credentials, and turn on multi-factor authentication where offered.
• Retain records of any suspicious contact in case you later need to report fraud.
• Run a free exposure scan of your email addresses to check whether your information has already surfaced in known breach data sets.

Official updates, if any, will come from the bank or competent authorities. Until more verified information appears, the measured response is vigilance, not alarm.

AICompiled with AI assistance from public sources and published under our editorial standards.