Data Breaches

SETTRA Ransomware Hits Six New US and Mexico Firms

September 23, 20264 min read

By James Okafor — CIPP/E certified, digital rights and privacy law specialist

SETTRA Ransomware Hits Six New US and Mexico Firms

SETTRA Ransomware Group Widens Its Reach

The SETTRA ransomware syndicate has added six new victims to its dark web leak site, expanding a campaign that now spans organizations in the United States and Mexico. Among the newly listed targets are Sánchez y Martín and NaturesPlus, both named directly on the group's extortion portal as the gang pressures companies into paying to prevent stolen data from being published.

This latest update follows the group's established playbook: infiltrate a network, exfiltrate sensitive files, encrypt systems, and then threaten public disclosure if a ransom isn't paid. That combination, known as double extortion, has become the default approach for most modern ransomware operations because it gives attackers two separate points of leverage instead of one.

How Double Extortion Escalates the Pressure

Traditional ransomware attacks relied solely on encryption. Victims who kept reliable backups could often recover without paying. Double extortion changes that calculation entirely. Even if a company restores its systems from backup, the attackers still hold copies of stolen data, and threaten to leak or sell it if the victim refuses payment.

This is precisely the model SETTRA appears to be following. By publishing victim names on a leak site, the group applies public reputational pressure alongside the technical damage of encrypted files. For enterprises, that means a single incident can trigger regulatory scrutiny, customer notification obligations, and lasting brand damage, regardless of whether a ransom is ultimately paid.

SETTRA is not a brand-new name in the ransomware landscape. Researchers previously flagged a new Settra ransomware variant hitting retail and manufacturing organizations, noting the group's ability to move quickly between sectors. The addition of six more victims across two countries suggests the operation is scaling its targeting rather than slowing down, and that earlier warnings about the variant's spread were not isolated incidents.

Why US and Mexico Businesses Are in the Crosshairs

Ransomware groups typically prioritize targets based on perceived ability to pay and the sensitivity of the data they hold, rather than any single industry or geography. The presence of victims in both the United States and Mexico indicates SETTRA is not confining itself to one region or vertical. Enterprises with cross-border operations, supply chain dependencies, or shared IT infrastructure may find themselves exposed simply because attackers cast a wide net once they find a working method of initial access.

For organizations like Sánchez y Martín and NaturesPlus, being named on a leak site is often the first public sign that an intrusion has already occurred, sometimes weeks or months earlier. That lag between compromise and public disclosure is one of the more troubling aspects of the ransomware economy. It means the actual scope of SETTRA's activity may be larger than what is currently visible on its leak site.

What This Means For You

If you are a customer, employee, or business partner of one of the newly listed organizations, there are a few practical steps worth taking. Watch for official breach notifications from the affected companies, and treat any unsolicited emails or calls referencing your account with caution, since stolen data is frequently used for follow-on phishing attempts. Changing passwords tied to any account associated with the affected organizations, and enabling multi-factor authentication where available, reduces the risk that leaked credentials can be reused elsewhere.

For IT and security teams at other companies, this incident is a reminder that ransomware groups iterate quickly. Reviewing backup integrity, testing incident response plans, and monitoring for the kind of remote access tooling commonly abused in these attacks are all reasonable, low-cost steps that reduce exposure without requiring a major security overhaul.

Key Takeaways

The expansion of SETTRA's leak site to six new victims across the US and Mexico underscores how quickly ransomware operations can scale once they find an effective method of compromise. Double extortion tactics mean that encryption is no longer the only threat; data theft and public shaming are now standard components of the attack chain.

Businesses should treat every new ransomware disclosure as an opportunity to reassess their own defenses rather than as an isolated event affecting someone else. Verifying backup recovery processes, monitoring for unusual remote access activity, and staying informed about active campaigns like SETTRA's are practical ways to stay ahead of a threat landscape that shows no signs of slowing down.

// FAQ

What is the SETTRA ransomware group accused of doing?

SETTRA added six new victims to its dark web leak site, spanning organizations in the United States and Mexico. The group infiltrates networks, exfiltrates sensitive files, encrypts systems, and threatens public disclosure if a ransom isn't paid.

Which companies were named as new victims?

Sánchez y Martín and NaturesPlus are among the newly listed targets named directly on the group's extortion portal. SETTRA added six new victims in total across the United States and Mexico.

What is double extortion in ransomware attacks?

Double extortion combines encryption with the threat of public disclosure of stolen data, giving attackers two separate points of leverage. Even if a company restores its systems from backup, attackers still hold copies of stolen data they threaten to leak or sell.

Why are US and Mexico businesses being targeted?

Ransomware groups prioritize targets based on perceived ability to pay and the sensitivity of data rather than any single industry or geography. The presence of victims in both countries indicates SETTRA is not confining itself to one region or vertical.

How might a company first learn it was compromised by SETTRA?

Being named on a leak site is often the first public sign that an intrusion has already occurred, sometimes weeks or months earlier. This lag between compromise and public disclosure is one of the more troubling aspects of the ransomware economy.