Trésor Public Listed by AuditTeam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 18, 2026, the ransomware group AuditTeam listed Trésor Public on its leak site and stated that it had exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and no further details about the scope or contents of the material have been made public. The incident concerns DGCPT, Senegal’s Direction Générale de la Comptabilité Publique et du Trésor, which operates under the Ministry of Finance.

What happened

The listing appeared on May 18, 2026. AuditTeam claimed responsibility for a ransomware operation that resulted in the exfiltration of internal files from Trésor Public. No information has been released about the date of the intrusion, the volume of data taken, the encryption of systems, or any ransom demand. The exact scale of the incident and whether the claimed files were subsequently published remain undisclosed.

Who is AuditTeam?

AuditTeam is a ransomware group that publishes victim names on a dedicated leak site when negotiations fail or to apply pressure. Such groups commonly gain initial access through phishing, exposed remote services, or compromised credentials, then move laterally inside networks before deploying encryption and copying selected files. Public records show the group has previously listed government and financial entities among its claimed targets, though each listing constitutes an unverified assertion by the group itself.

About Trésor Public

Trésor Public, formally the Direction Générale de la Comptabilité Publique et du Trésor, manages Senegal’s public accounting, government cash flow, fund disbursement, and public debt operations. As the central treasury authority, it processes payments to and from state entities and maintains records tied to national finances. A compromise at this level can affect the continuity of government payments and the confidentiality of administrative and financial records.

The information in question

The only detail provided is that internal files were allegedly exfiltrated. The precise categories of data, file counts, or time periods covered have not been disclosed. Organisations of this type routinely hold accounting ledgers, payment authorisations, supplier and beneficiary records, debt documentation, and internal correspondence; however, whether any of these specific materials were taken cannot be confirmed from available information.

The real-world impact

Exposure of treasury-related files could reveal details of government transactions and counterparties, creating risks of fraud, targeted scams, or operational disruption if systems were encrypted. Because the number of individuals whose personal information may be involved is unknown, the direct effect on citizens cannot yet be assessed. For the organisation, the incident adds to the workload of incident response, regulatory notification, and potential restoration of affected systems.

Were you affected?

Individuals who interact with Senegalese government financial services should monitor official statements from the Ministry of Finance and Trésor Public for any guidance on protective measures. Running a free exposure scan of your email address against known breach datasets can indicate whether your information has appeared in previously published collections, though it will not confirm involvement in this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.