Disuelas JC SAS Listed by tengu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 26, 2026, the ransomware group tengu listed Disuelas JC SAS on its leak site, claiming to have exfiltrated internal files from the Colombian company. Public information about the incident remains limited to that listing and the company’s basic registration details; the number of individuals affected has not been disclosed. The incident occurs against a backdrop in which ransomware operators continue to target manufacturing and mid-sized firms, often combining encryption with data theft to pressure victims.

Breaking down the breach

The only confirmed detail is the January 26, 2026 listing by tengu. No information has been released on the date of the intrusion, the volume of data taken, the encryption status of systems, or whether any ransom demand was issued or met. The company’s address, telephone number and legal form are publicly available through Colombian corporate registries, but these predate the reported incident.

The group behind it: tengu

Tengu is a ransomware operation that has appeared on leak sites since at least 2024. Like several other groups, it follows a double-extortion model: data is copied before encryption, and the group lists victims on a public site when negotiations fail. The listing of Disuelas JC SAS constitutes the group’s claim of responsibility; independent confirmation of the claimed access has not been published.

Who is Disuelas JC SAS?

Disuelas JC SAS is a sociedad por acciones simplificada registered in Bogotá, Colombia. Its stated activity is the manufacture of footwear components. Companies of this type routinely maintain records on suppliers, production schedules, employees and commercial contracts. A breach at such a firm can expose operational data that is not always subject to the same regulatory scrutiny as personal data held by larger retailers or financial institutions.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types or data categories has been made public. Organisations in the footwear-parts sector commonly store employee records, supplier contracts, design specifications and financial documents; whether any of these categories were among the files claimed by tengu is unconfirmed.

Why it matters

Even without a confirmed count of affected individuals, the exposure of internal files can create downstream risks for employees whose personal details appear in payroll or HR documents and for business partners named in contracts. For the company, the incident may complicate relationships with suppliers and customers who require evidence of adequate security controls. Regulatory obligations under Colombian data-protection rules will depend on the precise categories of personal data involved, which remain undisclosed.

Were you affected?

Individuals who have had commercial dealings with Disuelas JC SAS or who worked there can take the following steps:

• Monitor bank and credit accounts for unusual activity.
• Change passwords for any accounts that may reuse credentials stored in company systems.
• Request a copy of their personal data from the company under applicable data-protection law.
• Run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information.

No public mechanism has been announced for affected parties to obtain further details from either the company or the threat actor.

AICompiled with AI assistance from public sources and published under our editorial standards.