Perú Controls S.A.C. Listed by ElDorado Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For employees, suppliers and partners of a Peruvian grocery-retail company, the appearance of that firm on a ransomware group’s leak site raises immediate questions about whether internal records have left the organisation’s control. When a listing claims that files were taken, the practical concern is straightforward: personal or commercial information that was never meant to leave the company may now be in the hands of criminals who specialise in selling or publishing it.

On 4 January 2025, Perú Controls S.A.C. was listed by the ElDorado ransomware group. Public detail remains limited; the number of people affected is unknown and the precise contents of any stolen material have not been independently confirmed. What is known is that the group claims internal files were exfiltrated during a ransomware attack. That claim alone is enough to warrant careful attention from anyone whose data the company may hold.

Inside the incident

According to the available record, Perú Controls S.A.C. was listed by ElDorado on 4 January 2025. The listing characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No further technical details—such as the initial access method, the ransomware variant used, the exact date of intrusion, or the volume of data taken—have been disclosed in the public summary. The number of individuals whose information may be involved is listed as unknown. Because the only source for the claim is the group’s own leak-site entry, the incident should be treated as an unverified assertion until independent confirmation appears.

Who is ElDorado?

ElDorado is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also copying data, then threatening to publish the stolen material if a ransom is not paid. Groups of this type typically maintain dark-web leak sites where they post victim names, sample files and countdown timers. ElDorado has previously listed organisations across multiple sectors and regions, using the public exposure of data as leverage. In the present case the group claims to have taken internal files from Perú Controls S.A.C.; that claim has not been independently verified, and no additional statements or sample dumps specific to this victim have been confirmed in the available record.

Perú Controls S.A.C. and its sector

Perú Controls S.A.C. is described as a grocery-retail company based in Peru, with approximately 347 employees and reported revenue in the region of $19.1 million. Public business directories place a related entity, Control Union Perú SAC, in the same sector, headquartered in Miraflores, Lima, and employing between 250 and 499 people with revenue between $10 million and $25 million. Grocery-retail operators routinely manage supplier contracts, inventory systems, employee records, customer loyalty or payment data, and logistics information. A breach at such an organisation can therefore affect not only staff but also commercial partners and, potentially, end customers whose details are stored for ordering or delivery purposes. The sector’s reliance on continuous supply-chain coordination makes any disruption or data exposure operationally consequential.

What data was at risk

The only data type named in the public record is “internal files” said to have been exfiltrated. No inventory of specific categories—such as employee identification documents, payroll records, supplier contracts, customer lists or financial statements—has been released. Organisations of this size and sector typically hold human-resources files, commercial agreements, inventory databases and, in some cases, limited customer contact or payment information. Because the exact contents remain undisclosed, it is not possible to state with certainty which of these categories, if any, were among the material claimed by ElDorado. Readers should treat any assertion about particular data types as unconfirmed until further evidence appears.

What's at stake

For individuals, the principal risks are identity misuse, targeted phishing and, where financial or contact details are involved, fraud. Even purely internal documents can contain enough personal information—names, national identity numbers, addresses, salary figures—to enable social-engineering attacks. For the company itself, the stakes include operational disruption if systems remain encrypted, regulatory scrutiny under Peruvian data-protection rules, loss of supplier or customer confidence, and the longer-term cost of forensic investigation and remediation. Because the scale of the claimed exfiltration is unknown, the full extent of these risks cannot yet be quantified.

What to do if you're exposed

Anyone who has worked for, supplied or done business with Perú Controls S.A.C. should monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and financial services, and treat unsolicited messages that reference the company with caution. Changing passwords that may have been reused across work and personal accounts is a prudent first step. Free exposure-scan tools that check whether an email address appears in known breach corpora can provide an early indication that personal data has circulated; such a scan does not confirm involvement in this specific incident but can highlight whether further protective measures are warranted. If official notification arrives from the company or from Peruvian authorities, follow the guidance it contains and retain copies of any correspondence for reference.

AICompiled with AI assistance from public sources and published under our editorial standards.