ECKERD PERU S.A, INKAFARMA, MIFARMA Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The ECKERD PERU S.A, INKAFARMA, MIFARMA Listed by revil Ransomware Group (reported October 8, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
Breaking down the breach
The only public record is the entry on the revil leak site dated 8 October 2021. The entry asserts that internal files were removed. No additional details on the volume of data, the method of initial access, or the timeline of the operation have been released by the group or by the organisation. The number of people potentially affected remains unknown.
The group behind it: revil
revil was a ransomware-as-a-service operation active from 2019 until mid-2022. The group supplied encryption tools to affiliate attackers and maintained a public leak site where stolen data was posted when ransom demands were not met. Its affiliates typically used remote-desktop or software-vulnerability routes to gain entry, then moved laterally to locate and copy files before deploying encryption. The group was linked to several high-profile incidents before its infrastructure was disrupted by coordinated law-enforcement action in 2022.
ECKERD PERU S.A, INKAFARMA, MIFARMA and its sector
ECKERD PERU S.A operates the INKAFARMA and MIFARMA pharmacy chains in Peru. These retail networks process prescriptions, customer loyalty records and supplier contracts. Pharmacies routinely hold personal identifiers, purchase histories and limited health information. A compromise at such an operator can therefore expose both commercial records and data that individuals consider sensitive.
The information in question
The leak-site posting refers only to “internal files.” No inventory of file types or data categories has been published. Organisations of this kind commonly store customer names, addresses, national identification numbers, prescription details and financial transaction records. The exact contents of the material claimed to have been taken have not been confirmed.
The real-world impact
Individuals whose records appear in the exfiltrated material could face increased risk of identity fraud or targeted scams. The organisation faces potential regulatory scrutiny and costs associated with investigation and remediation. Because the scale and sensitivity of the data remain undisclosed, the full extent of these risks cannot yet be measured.
What to do if you're exposed
Monitor bank and credit-card statements for unusual activity and consider placing a fraud alert with credit bureaus. Use a unique password for each account and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
University Medical Center Listed by revil Ransomware GroupFujifilm Listed by revil Ransomware Groupmedibank.com.au Listed by revil Ransomware GroupPTT Exploration and Production - 720GB Listed by revil Ransomware GroupLatest breaches
Publicly posted by revil — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.