SubsCorp Listed by arcusmedia Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized enterprises across Latin America, using double-extortion tactics that combine encryption with the public threat of data leaks. In this environment, even limited public listings can signal real operational disruption and potential exposure of internal material. On 22 July 2025, SubsCorp appeared on a leak site associated with the arcusmedia ransomware group, marking another claim of compromise against a Colombian firm.

Public detail remains sparse. The listing asserts that internal files were exfiltrated during a ransomware attack, yet the number of people affected is unknown and no further technical confirmation has been released. For employees, partners and customers of SubsCorp, the claim itself is enough to warrant attention and basic protective steps.

Breaking down the breach

According to the available record, SubsCorp was listed by the arcusmedia ransomware group on 22 July 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No independent confirmation of the intrusion, the precise date of initial access, or the volume of data taken has been published. The number of individuals affected is listed as unknown. A countdown timer displayed alongside the listing read “Days06Hours23Minutes39Secondes43,” a common feature on such sites that signals an approaching deadline for payment or public release. Beyond these points, method of entry, ransom demand and any negotiation status remain undisclosed.

Who is arcusmedia?

Arcusmedia is a ransomware operation that follows the now-standard double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it if payment is not made. Like many contemporary groups, it maintains a dedicated leak site where it posts victim names, sample files and countdowns. Public reporting on arcusmedia has described typical tactics that include initial access through phishing or vulnerable remote services, lateral movement, data staging and eventual encryption. The group’s listings are claims; they do not by themselves prove that every named organisation suffered the full extent of compromise asserted. In this case, the only verified public statement is the appearance of SubsCorp on the arcusmedia site together with the assertion that internal files were taken.

About SubsCorp

Subs Corp S.A.S. is a Colombian company headquartered in Barranquilla. Public records describe it as a commercial enterprise operating within the country’s private sector. Organisations of this type routinely maintain internal business records, employee information, supplier contracts, financial documents and operational data necessary for day-to-day administration. A ransomware incident at such a firm can interrupt logistics, payroll, customer service and regulatory reporting. Because the company sits inside Colombia’s commercial ecosystem, any confirmed data exposure could also affect local partners and clients who exchange information with it.

What was likely exposed

The only data category named in the public record is “internal files exfiltrated in ransomware attack.” No inventory of file types, no sample documents and no confirmation of personal identifiers, financial records or credentials have been released. Companies comparable to SubsCorp typically hold employee personnel files, internal correspondence, accounting ledgers, vendor agreements and operational manuals. Whether any of those categories were among the files claimed by arcusmedia is unconfirmed. Until more detail emerges, the precise contents of the alleged exfiltration remain unknown.

What's at stake

For individuals whose information may have been stored in internal systems, the practical risks include targeted phishing that references real company details, identity-related fraud if personal data was present, and long-term monitoring of credit or government records. For SubsCorp itself, the consequences can include operational downtime, recovery costs, potential regulatory scrutiny under Colombian data-protection rules, and reputational strain with partners who rely on the confidentiality of shared information. Because the scale of the incident is undisclosed, the full extent of these risks cannot yet be quantified; the listing alone, however, creates a credible basis for caution.

If your data was in this claimed breach

If you have a past or present relationship with SubsCorp—as an employee, contractor, supplier or customer—treat the claim seriously even while details remain limited. Change passwords used for any company-related accounts, enable multi-factor authentication wherever available, and watch for unexpected messages that appear to come from the organisation. Monitor financial statements and credit reports for unusual activity. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Keep records of any suspicious contact and report confirmed fraud to the appropriate Colombian authorities. Further official statements from SubsCorp or law-enforcement agencies, if released, will provide the next reliable update.

AICompiled with AI assistance from public sources and published under our editorial standards.