suppcentersa.com Listed by m3rx Ransomware Group: What Was Exposed & What To Do

Ransomware groups continue to target managed security service providers and technology partners across Latin America, using leak-site listings to pressure victims after claimed data theft. In this environment, even organizations that specialize in cybersecurity can appear on such lists, raising questions for clients and partners who rely on them for protection.

On July 17, 2026, the domain suppcentersa.com was listed by the ransomware group m3rx. Public detail is limited: the number of people affected remains unknown, and the group claims that internal files were exfiltrated in a ransomware attack. The listing itself is an unverified claim; no independent confirmation of the intrusion or the full scope of any theft has been provided in the available record.

What happened

According to the reported listing, m3rx claimed responsibility for a ransomware attack against suppcentersa.com and stated that internal files had been exfiltrated. The date associated with the public report is July 17, 2026. No further operational details—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed. The number of individuals potentially affected is listed as unknown. The record notes only that internal files were claimed as stolen; no inventory of those files has been made public.

Inside m3rx

m3rx is a ransomware operation that has appeared in public reporting as a group that combines encryption with data theft and subsequent leak-site pressure. Like many contemporary ransomware actors, it typically posts victim names and claimed evidence of exfiltration on a dedicated site to encourage payment. Public documentation of the group describes a pattern of targeting organizations across multiple sectors and geographies, often focusing on entities whose disruption or data exposure could create operational or reputational leverage. Specific claims made by m3rx about any single victim, including the listing of suppcentersa.com, remain assertions by the group until independently verified. No additional statements attributed to m3rx about this particular incident appear in the available facts beyond the listing itself and the reference to internal files.

suppcentersa.com and its sector

SuppCenter Global Services, associated with the domain suppcentersa.com, positions itself as a leading Xcitium solution partner and provider in the Latin America region. Xcitium is the rebranded enterprise business formerly known as Comodo. The organization’s stated specialization centers on threat-prevention architecture that uses Xcitium Zero Trust and ZeroDwell technologies. It operates as a managed security service provider (MSSP), implementing, configuring, and supporting Xcitium/Comodo security solutions for large businesses, retail companies, and public-sector clients. Contact information associated with the entity includes the telephone number +506 40003397.

Organizations in the MSSP and cybersecurity-partner sector typically hold configuration data, client environment details, support tickets, and sometimes credentials or logs related to the security tools they manage. A claimed breach at such a provider is consequential because it can affect not only the provider’s own operations but also the trust and security posture of the customers who depend on its services. Public detail does not confirm whether any client data was involved in this incident.

What data was at risk

The available record states that internal files were exfiltrated in a ransomware attack. No more granular list of data types—such as customer records, employee information, financial documents, or source code—has been disclosed. The stolen-data field in the report is empty beyond that general description. Organizations of this kind commonly maintain internal operational files, client-support materials, and technical documentation; however, the exact contents of any files claimed by m3rx remain unconfirmed. Readers should treat any specific data categories as unknown until further verified information appears.

The real-world impact

For individuals or organizations that have worked with SuppCenter Global Services, the primary risks associated with a claimed internal-file exfiltration include potential exposure of business correspondence, technical configurations, or support-related information that could be misused for social engineering or further targeting. Because the scale of any theft and the identities of affected parties are unknown, the concrete impact cannot be quantified from public sources. For the organization itself, a ransomware listing can create operational disruption, reputational pressure, and the need to investigate and contain any confirmed intrusion. Clients of an MSSP may also face secondary concerns about whether their own environments or data were reachable through the provider, even if no such linkage has been established in this case.

Were you affected?

If you have had a business or technical relationship with suppcentersa.com or SuppCenter Global Services, consider the following practical steps:

• Monitor official communications from the organization for any confirmed notices or guidance.
• Review accounts and systems that may have interacted with the provider for unusual activity.
• Enable multi-factor authentication and change passwords on related services where appropriate.
• Remain alert to phishing or social-engineering attempts that reference the company or its services.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets.

Public information about this incident remains limited. Treat the m3rx listing as a claim rather than confirmed fact, and rely on verified updates from the organization or competent authorities for any further details.

AICompiled with AI assistance from public sources and published under our editorial standards.