Preference Portugal Listed by malas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 9 April 2023, Preference Portugal appeared on a leak site operated by the ransomware group known as malas. The listing asserts that internal files were taken in a ransomware attack that exploited a Zimbra vulnerability. How many people may be affected remains unknown, and the precise contents of the files have not been publicly detailed. For anyone who has dealt with the organisation, the practical concern is straightforward: internal business records can contain personal and contact details that, once outside the organisation’s control, may be misused for fraud, phishing or further targeting.

Public information about the incident is limited to the group’s claim and the reported method of entry. No independent confirmation of the full scope has been released in the material available here, so the situation calls for calm attention rather than assumption.

Inside the incident

According to the reported summary, the intrusion relied on a vulnerability in Zimbra, software commonly used for email and collaboration. The attackers are said to have exfiltrated internal files as part of a ransomware operation. The date associated with the public listing is 9 April 2023. The number of people affected is unknown, and no further technical timeline, ransom demand, or confirmation of data publication has been supplied in the available facts. The leak-site entry itself constitutes a claim by the group rather than verified disclosure by the organisation or independent investigators.

Because scale and exact file inventories remain undisclosed, it is not possible to state with certainty what volume of material left the network or whether any of it has been released more widely. The core known elements are the attribution to malas, the use of a Zimbra vulnerability, and the assertion that internal files were taken.

Who is malas?

Malas is a ransomware group that has appeared in public reporting as an actor that encrypts systems and threatens to publish stolen data unless payment is made. Like many such groups, it typically gains initial access through known vulnerabilities or exposed services, moves laterally, exfiltrates material, and then posts victim names on a dedicated leak site to increase pressure. Prior public activity associated with the name has followed this double-extortion pattern common among ransomware operations in recent years.

In this case, the group claims Preference Portugal as a victim and states that internal files were exfiltrated. No additional statements from malas specifically about this organisation—beyond the listing itself—are included in the facts. The listing should therefore be treated as an unverified claim until corroborated by the organisation or other reliable sources.

About Preference Portugal

Preference Portugal is an organisation operating in Portugal. Entities of this type commonly handle customer or partner records, internal correspondence, operational documents and systems that support day-to-day business. Even when an organisation is not a household name, the data it holds can include names, contact details, contractual information and other material that individuals would reasonably expect to remain protected.

A breach involving internal files is consequential because those files often sit at the intersection of business operations and personal information. Disruption or exposure can affect both the organisation’s ability to function and the privacy of people whose details appear in ordinary business records. Public detail on Preference Portugal’s exact size, sector specialisation or customer base is limited in the material provided, so broader conclusions about impact rest on the general nature of such holdings rather than specific confirmed inventories.

The information in question

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of data types—such as customer databases, employee records, financial documents or email archives—has been disclosed. Organisations that use collaboration platforms like Zimbra typically store email, calendars, contacts and shared documents; these can contain personal identifiers, correspondence and business-sensitive material. Whether any of those categories were present in the taken files is unconfirmed.

Because the exact contents remain undisclosed, it is not accurate to assert that specific categories of personal data were exposed. The only confirmed description available is “internal files.” Anyone who has interacted with Preference Portugal should therefore proceed on the cautious assumption that ordinary business records associated with them could be involved, while recognising that this has not been verified in detail.

What's at stake

For individuals, the main risks are secondary misuse of any personal or contact information that may have been present in the files. That can include targeted phishing messages that appear more credible because they reference real relationships or transactions, attempts at identity fraud, or unwanted contact. Without a confirmed list of affected people or data fields, these remain potential rather than proven harms for any given person.

For the organisation, the stakes include operational disruption from the ransomware event itself, possible regulatory attention under data-protection rules, and the longer-term task of determining what left the network and notifying those who may be affected. Reputation and trust can also be affected when a leak-site listing appears, even before full facts are known. None of these outcomes has been quantified in the available information; they are the ordinary consequences that follow this type of claim.

If your data was in this claimed breach

If you believe you may have had dealings with Preference Portugal, a few measured steps are worth taking while public detail remains limited.

• Treat unexpected emails, calls or messages that reference the organisation or your past interactions with heightened caution; verify through official channels before responding or clicking links.
• Monitor financial and account statements for unfamiliar activity and enable stronger authentication where available.
• Consider changing passwords on accounts that may have shared credentials or recovery information tied to any email address used with the organisation.
• Keep records of any suspicious contact so you can report it to the relevant authorities or the organisation if needed.
• You can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Further official statements from Preference Portugal or independent investigators would clarify the true scope. Until then, the prudent course is basic vigilance rather than alarm.

AICompiled with AI assistance from public sources and published under our editorial standards.