validcertificadora.com.br Listed by crosslock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that handles digital identity and certification appears on a ransomware group's leak site, the practical concern for customers, employees and partners is straightforward: internal files may have left the organisation's control, and those files can contain personal or business information that outsiders can misuse. Public reporting does not yet say how many people are involved or exactly which records were taken, so anyone who has dealt with validcertificadora.com.br has reason to treat the claim seriously and watch for follow-on fraud.

On 17 April 2023 the domain validcertificadora.com.br was listed by the ransomware group known as crosslock. The listing asserts that internal files were exfiltrated in a ransomware attack. Independent confirmation of the full scope remains limited, and the number of people affected is unknown.

What happened

According to public breach tracking, validcertificadora.com.br was named on crosslock's leak site on 17 April 2023. The available summary states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of affected individuals, or the precise date the intrusion began. Method of initial access, ransom demand, and whether any data was later published in full have not been disclosed in the material available for this report. The incident is therefore best understood as a claimed double-extortion event in which the group alleges both encryption and theft of internal material, without independent verification of every detail at the time of reporting.

Inside crosslock

Crosslock is a ransomware operation that has appeared in public threat reporting since roughly 2022. Like many contemporary groups, it has been associated with double-extortion tactics: encrypting systems to disrupt operations while also copying data and threatening to release it if a payment is not made. Listings on its leak site function as pressure on the victim and as advertising to other criminals. The group has been observed using common ransomware playbooks—initial access through compromised credentials or exposed services, lateral movement, data staging, and then deployment of encryptors—though specific tooling can vary by intrusion. Because leak-site posts are controlled by the attackers, each new victim name should be treated as a claim until the organisation or independent investigators corroborate what was taken and whether files were actually released.

In this case, crosslock's listing of validcertificadora.com.br is exactly that: an unverified claim that internal files were exfiltrated. No further statements from the group about this specific victim are included in the facts at hand.

Who is validcertificadora.com.br?

Validcertificadora.com.br is associated with VALID Certificadora Digital Ltda, a Brazilian company headquartered in São Paulo. Public business descriptions place it in a mid-sized bracket, with roughly 501–1,000 employees and reported revenue in the $100 million to $250 million range. Despite one abbreviated industry tag that appears in secondary summaries, the organisation's name and market role point to digital certification and related identity services—work that typically involves issuing and managing digital certificates, supporting secure electronic transactions, and handling identity-related documentation for individuals and organisations in Brazil.

Companies in this sector sit at a sensitive junction: they process applications, identity documents, contact details, and technical certificate data. A breach affecting such an operator can therefore reach beyond the company's own staff to customers who rely on its certificates for banking, government, or commercial authentication. That concentration of trust is why a ransomware listing against a certificadora draws attention even when full technical details remain sparse.

What data was at risk

The facts name the exposed material only as "internal files exfiltrated in a ransomware attack." No inventory of file types, databases, or record counts has been published in the material used for this article. The number of people affected is unknown.

Organisations that issue digital certificates and related identity services commonly hold customer registration data, identity-document images or numbers, business contact information, employee records, internal correspondence, and technical logs tied to certificate issuance. It is reasonable to expect that some mix of those categories could exist inside a certificadora's systems; it is not established that any particular category was in the set crosslock claims to have taken. Until the company or a regulator publishes a confirmed list, the exact contents remain unconfirmed.

Why it matters

For individuals, the main risks are secondary fraud and long-term misuse of identity data. If names, document numbers, addresses, or contact details were among the internal files, criminals can attempt phishing, account takeover, or fraudulent applications that exploit the victim's trust in a known brand. Even purely internal business documents can reveal enough about contracts or processes to support targeted social engineering against staff or clients.

For the organisation, a ransomware event that includes exfiltration raises operational, legal, and reputational costs: system recovery, possible regulatory notification duties under Brazilian data-protection rules, and the need to support customers who may be unsure whether their information was involved. Because the scale is undisclosed, both the company and the public are left managing uncertainty rather than a clearly bounded incident.

Were you affected?

If you have been a customer, employee, or partner of validcertificadora.com.br, treat unsolicited messages that reference certificates, account problems, or urgent payments with caution. Prefer official channels you already trust, enable multi-factor authentication where available, and monitor financial and government accounts for unexpected activity. Consider placing fraud alerts with relevant Brazilian credit or identity services if you believe sensitive documents may have been exposed. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach datasets, which can help you prioritise password changes and further monitoring while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.