[Petro_Escobar]

Hello, Darkforums community:

Today, in collaboration with @NyxarGroup, we are exposing Emergia Contact Center and Conalcréditos (a debt collection unit), as well as PLUS CONTACTO SERVICIOS INTEGRALES SL, operated by Albert Ollé, one of Spain’s wealthiest businessmen.

The leak originated from an internal source in the customer security department (Carlos David Garay Mora), who recently worked at the company. This individual hired our penetration testing services, which revealed that the company’s technology and cybersecurity management is not merely deficient—it is downright deplorable.

To date, the CISO, Fernando Alfonso Cortes (or, as he likes to call himself, the “information security officer”), has manipulated and distorted the facts, even going so far as to reduce his own clients to mere numbers (“cash and money”). Together with Maritza Garzón and Raquel Martín, they have concocted an absurd narrative claiming that the exfiltrated data is old and comes from an irrelevant CRM. That is false. The intrusion began by exploiting vulnerabilities in the perimeter, specifically in an obsolete Cisco ASA. From there, the attackers pivoted to the Fortinet topology connecting Spain (Gran Canaria, Madrid, Córdoba, Catalonia) with Colombia (Bogotá, Medellín, Manizales/Pensilvania, Malambo - Davivienda). They pretend to be a PCI-DSS compliant entity when they don’t even meet the basics: compromised cryptographic controls, inactive users left unweeded, and CISCO VPN SSL traffic without MFA.

We also found a public Active Directory password reset portal: https://systemservices.emergiacc.com/Res...a/#/inicio Critical services were exposed with weak certificates, which allowed us to escalate to full control of the environment, including resetting Kerberos credentials. We gained access to corporate emails (emergiacc) and the entire user directory in GSuite. And yet they claim they “came out of it unscathed” without having any real idea of the source of the data exfiltration. Let’s talk a bit more about Fernando Alfonso Cortez: arrogance without competence. He couldn’t manage a critical incident with BBVA. They showed up to a meeting with the client themselves WITHOUT KNOWING ANYTHING after three days of active intrusion, without even realizing they were compromised. They didn’t rotate credentials; they didn’t contain anything. We maintained access until April 7. They simply didn’t know where they were being breached.

Over the course of two months, we extracted approximately 12 TB of data: shared resources, PST files, SFTP files, and full backups. The only client that reacted in time was BBVA-Nu Bank, which identified the data exfiltration as soon as we published evidence—even before its own provider did. The rest—Davivienda, Falabella, Lulo Bank, Finandina, Endesa, GMAC, Serfinanza, Banco de Bogotá, among others—chose to remain silent. And yet they have the audacity to claim that it is “old data.” The level of negligence is grotesque: failures in secure deletion, a lack of real controls, and yet, baseless public threats. For a CISO not to step forward and instead blame third parties is simply pathetic. Not to mention disastrous. Since they have chosen to lie to and manipulate their customers, we will proceed to escalate this to the media. Samples will be sent to the press with evidence of the 75 compromised clients. We also urge these media outlets to investigate the role of FUNDACIÓN VALORA T as a possible vehicle for money laundering, as well as the use of PLUS CONTACTO SERVICIOS INTEGRALES for recruiting personnel for profit-making purposes in BPO.

As part of this agreement, we will sell the 12 TB for $3,000, which includes the following 

services > Spanish
customers Endesa Mobilize Mas+Orange Lowi Loyalty Vodafone Orange Jazztel Iberdrola Genalse ING Mas Móvil Llamaya Simyo - Amena Yoigo ETC …... 

conalcreditos > 

upress bogota- disan colombia compra eficiente gm Finalcial falabella administratvio falabella recobros credivalores banco de bogota banco agrario bbva banco agrario banco finandina nu bank lulo bank bupa min transporte PRA Group Victims’ Unit Banco de Occidente Banco Popular Banco AV Villas Banco W Crediuno Giros y Finanzas Servimotos Yamaha GMAC Chevrolet Banco Comeva National Savings Fund CENDA CFA

Emergia CC SL > 

Bancolombia – Medellín Claro Mobile Avista ETB Davivienda Seguros Bolívar Colsanitas Colsubsidio Repsol Seguros SBS Colombia Seguros Sura Altice UNICEF Transmilenio Enel X Entel Flamingo Flypass 

Proving that this is real, current information from recent customers, not the false narrative they tried to sell. 

Contact via Simplex

Simplex

[reLnpTpG]

Good Job

[TheAggrexxor]

Astonishing job!