Iris Neofinanciera Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a financial firm appears on a ransomware group's leak site, the people who matter most are its clients and staff. Their personal details, account-related records and day-to-day work files may now sit outside the organisation's control. Public reporting so far gives only a partial picture, yet even that limited picture is enough to warrant careful attention from anyone who has dealt with Iris Neofinanciera.

On 8 April 2025 the ransomware group crypto24 listed Iris Neofinanciera as a victim. The group claims it exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. What follows is a factual account of what is known, what is claimed, and what those potentially affected can usefully do next.

What happened

According to the listing posted by crypto24, Iris Neofinanciera suffered a ransomware attack in which internal files were taken. The reported summary states that the material includes all files from Google Drives, Google Chat data, WorkManager documents covering the last five years, SQL databases, and personal information of clients and staff. The date the listing was reported is 8 April 2025. No public figure has been given for the number of individuals whose data may be involved, and the precise method of initial access has not been disclosed in available reporting. The listing itself is a claim by the group; it has not been independently verified in the sources used for this account.

Who is crypto24?

crypto24 is a ransomware operation that has appeared in public threat reporting in recent years. Like many contemporary ransomware groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a leak site on which it names organisations it claims to have compromised and, in some cases, posts samples or larger archives of stolen material. Its public activity has focused on a range of commercial and professional victims rather than a single industry. When crypto24 lists a new name, the listing is best treated as an unverified claim until the organisation or independent investigators state the details. No statements attributed to crypto24 beyond the general description of the files it says it took from Iris Neofinanciera are available in the facts at hand.

About Iris Neofinanciera

Iris Neofinanciera operates in the financial-services sector. Firms of this type typically handle client onboarding records, identification documents, account and transaction data, internal communications, and personnel files for their own staff. Because they sit at the intersection of personal identity information and financial activity, a breach at such an organisation can expose material that is useful for fraud, impersonation or further social-engineering attacks. Public detail about Iris Neofinanciera's exact size, client base or geographic footprint is limited in the reporting connected to this incident; the consequential point is simply that any organisation holding client and staff personal data becomes a high-value target once that data leaves its systems.

What data was at risk

The crypto24 listing claims the following categories were exfiltrated: all files stored in Google Drives, Google Chat data, WorkManager documents spanning the previous five years, SQL databases, and personal information belonging to both clients and staff. These descriptions come directly from the group's reported summary. No independent inventory or confirmation of the exact contents has been published, so the precise fields, volume or sensitivity of individual records remain unconfirmed. Organisations in the financial sector commonly hold names, contact details, government identifiers, account numbers, correspondence and employment records; whether any or all of those elements are present in the material crypto24 claims to hold cannot be verified from the available facts.

What's at stake

For individuals, the practical risks are identity misuse, targeted phishing, and attempts to open accounts or take loans in their names. Staff whose personal or employment data may be included face similar exposure plus the possibility that internal communications could be used to craft more convincing scams. For the organisation the stakes include regulatory scrutiny, potential notification duties, reputational damage and the operational cost of investigation and remediation. Because the number of affected people is unknown and the full data set has not been independently described, the scale of these risks cannot yet be quantified. The absence of confirmed numbers does not reduce the need for caution among anyone who has shared personal information with the firm.

Were you affected?

If you are a current or former client or employee of Iris Neofinanciera, treat the possibility of exposure seriously even while details remain incomplete. Monitor financial accounts and credit reports for unexpected activity, be sceptical of unsolicited messages that reference the firm or request sensitive information, and consider placing fraud alerts with relevant credit bureaux where available. Change passwords on any accounts that may have reused credentials linked to the organisation. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check will not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal risk assessment. Official statements from Iris Neofinanciera, if and when they appear, should be treated as the primary source for further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.