{
	"id": "6b201f2c-0a34-4d69-9a03-0ab5737461a7",
	"created_at": "2026-04-06T00:19:07.891733Z",
	"updated_at": "2026-04-10T03:21:50.929329Z",
	"deleted_at": null,
	"sha1_hash": "e42398590ed76a8d6cca3a69354825180b015515",
	"title": "Retail giant Cencosud hit by Egregor Ransomware attack, stores impacted",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2760250,
	"plain_text": "Retail giant Cencosud hit by Egregor Ransomware attack, stores\r\nimpacted\r\nBy Lawrence Abrams\r\nPublished: 2020-11-15 · Archived: 2026-04-05 18:56:56 UTC\r\nChilean-based multinational retail company Cencosud has suffered a cyberattack by the Egregor ransomware operation that\r\nimpacts services at stores.\r\nCencosud is one of the largest retail companies in Latin America, with over 140,000 employees and $15 billion in revenue\r\nfor 2019. Cencosud manages a wide variety of stores in Argentina, Brazil, Chile, Colombia, and Peru, including Easy home\r\ngoods, Jumbo supermarkets, and the Paris department stores.\r\nThis weekend, Cencosud was hit with a ransomware attack that encrypted devices throughout their retail outlets and\r\nimpacted the company's operations.\r\nhttps://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nAccording to Argentinian publisher Clarín, retail stores are still open, but some services are impacted.\r\nFor example, an Easy store in Buenos Aires is displaying a sign warning customers that they are not accepting\r\nthe 'Cencosud Card' credit card, accepting returns, or allowing the pickup of web purchases due to technical problems.\r\nIf you have first-hand information about this or other unreported cyberattacks, you can confidentially contact us on Signal\r\nat +16469613731 or on Wire at @lawrenceabrams-bc.\r\nEgregor behind ransomware attack\r\nAfter learning of the attack, BleepingComputer obtain the ransom note and can confirm it was conducted by Egregor and\r\ntargeted the 'Cencosud' Windows domain.\r\nCencosud's Egregor ransom note\r\nEgregor is a ransomware-as-a-service operation that began operating in the middle of September, just as another\r\nransomware group known as Maze started shutting down their operation. BleepingComputer has learned from threat actors\r\nthat many hackers who partnered with Maze are now working with Egregor.\r\nClarín also reported that printers in numerous retail outlets in Chile and Argentina, such as Easy home goods stores, began\r\nprinting out ransom notes as devices are encrypted.\r\nThis function is a known \"feature\" of the Egregor ransomware software, which will automatically print ransom notes to\r\nattached printers after the files on a device have been encrypted.  For network-wide attacks, this could potentially lead to\r\nthousands of ransom notes being printed throughout the organization.\r\nThe ransom note does not provide links to proof of stolen data, but Egregor has a history of stealing unencrypted files before\r\ndeploying their ransomware.\r\nEgregor has been responsible for other high profile attacks on Crytek, Ubisoft, and Barnes and Noble.\r\nhttps://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/\r\nPage 3 of 4\n\nBleepingComputer has contacted Cencosud with further questions but has not heard back.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/\r\nhttps://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/"
	],
	"report_names": [
		"retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted"
	],
	"threat_actors": [
		{
			"id": "d90307b6-14a9-4d0b-9156-89e453d6eb13",
			"created_at": "2022-10-25T16:07:23.773944Z",
			"updated_at": "2026-04-10T02:00:04.746188Z",
			"deleted_at": null,
			"main_name": "Lead",
			"aliases": [
				"Casper",
				"TG-3279"
			],
			"source_name": "ETDA:Lead",
			"tools": [
				"Agentemis",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"RbDoor",
				"RibDoor",
				"Winnti",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434747,
	"ts_updated_at": 1775791310,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e42398590ed76a8d6cca3a69354825180b015515.pdf",
		"text": "https://archive.orkl.eu/e42398590ed76a8d6cca3a69354825180b015515.txt",
		"img": "https://archive.orkl.eu/e42398590ed76a8d6cca3a69354825180b015515.jpg"
	}
}