latamlex (gyg.local) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 12, 2025, the ransomware group known as incransom listed latamlex (gyg.local) on its leak site, claiming to have conducted a ransomware attack that involved the exfiltration of internal files. Public details remain limited: the number of people affected is unknown, and no further confirmation of the incident beyond the group's listing has been provided in available records.

As a regional law firm serving clients across Central America, any compromise of latamlex's systems raises concerns about the potential exposure of sensitive professional materials. This matters because law firms routinely handle confidential client information, and ransomware claims of this type often signal both operational disruption and data theft risks that can affect individuals and businesses connected to the firm.

What happened

According to the available record, latamlex (gyg.local) was listed by the incransom ransomware group on November 12, 2025. The group claims the incident involved a ransomware attack in which internal files were exfiltrated. No additional public details have been disclosed regarding the precise timing of any intrusion, the scale of systems affected, the method of access, or whether encryption of systems occurred alongside the claimed data theft. The number of people potentially affected remains unknown, and the listing itself constitutes an unverified claim by the group rather than independently confirmed evidence.

Who is incransom?

Incransom is a ransomware group that operates in the well-documented model of double-extortion attacks. Such groups typically gain unauthorized access to an organization's networks, exfiltrate data, and then encrypt systems while threatening to publish the stolen material on dedicated leak sites if a ransom is not paid. Public reporting on incransom and similar actors shows they frequently target a range of sectors, including professional services, and use leak-site postings as leverage. In this case, the group's listing of latamlex is presented as a claim of successful exfiltration of internal files; no further statements or specific demands attributed to incransom regarding this particular victim appear in the provided facts.

About latamlex (gyg.local)

Latamlex is a regional law firm with a team of over 100 attorneys and more than 20 years of experience. It is recognized for expertise in areas including arbitration, corporate law, and intellectual property. The firm serves local entrepreneurs seeking international expansion as well as multinational corporations establishing or growing operations in Central America. With offices across five countries, it positions itself as combining international vision with local knowledge. Law firms of this type typically manage substantial volumes of privileged and confidential material—client contracts, corporate records, intellectual-property filings, arbitration documents, and personal data of clients and staff—making any claimed breach consequential for both the organization and those who rely on its services.

What was likely exposed

The available facts state that internal files were exfiltrated in a ransomware attack. No more specific data types, file counts, or categories have been named or confirmed. Organizations such as regional law firms commonly hold client correspondence, legal pleadings, corporate formation documents, intellectual-property records, financial information related to matters, and personal details of attorneys, staff, and clients. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of these materials, if any, were among the files the group claims to have taken. Public detail on the precise nature of the exposed data is limited to the description of internal files.

The real-world impact

For individuals and businesses connected to latamlex, the primary risks center on the possible misuse of any confidential information that may have been taken. Clients could face exposure of sensitive commercial strategies, ongoing legal disputes, or personal data, which in turn might enable targeted phishing, identity-related fraud, or competitive harm. The firm itself may encounter operational disruption, reputational damage, regulatory scrutiny under data-protection rules applicable in the jurisdictions where it operates, and the costs of investigation and remediation. Because the number of people affected is unknown and the full scope of files is undisclosed, the concrete extent of these risks cannot yet be quantified. Even unconfirmed claims of this nature often prompt organizations to notify clients and review security practices as a precaution.

Were you affected?

If you are a client, employee, or partner of latamlex, monitor communications from the firm for any official notifications. Consider placing fraud alerts with credit bureaus if personal data may be involved, review account statements for unusual activity, and be cautious of unsolicited emails or calls that reference legal matters or the firm. Changing passwords on related accounts and enabling multi-factor authentication where available are practical immediate steps. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets, which can provide an early indication of wider exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.