# Pirámide Seguros breached by GUNRA ransomware

Published: 2026-06-30 · Severity: routine · Sectors: financial-services
Canonical: https://vorant.io/reports/607b4a3e-d4f8-5183-b47b-11c24c4a4329/pir-mide-seguros-breached-by-gunra-ransomware

> GUNRA ransomware gang claims breach of Pirámide Seguros with 708 compromised users and exposed employee credentials.

GUNRA ransomware operators have publicly claimed a breach of Pirámide Seguros, a Latin American insurance provider. The breach encompasses 708 compromised user accounts and 8 third-party employee credentials, indicating both internal account compromise and supply-chain credential exposure. The threat actors have posted details of the intrusion on ransomware.live, a public tracking platform. The breach suggests attackers gained access to employee credentials, likely via infostealer malware infections that preceded ransomware deployment. Defenders in the financial services and insurance sectors should monitor for indicators of compromise and credential stuffing attempts using the exposed credentials.

## Mentioned in this report

- Threat actors: gunra
- Malware: Gunra

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/UGlyw6FtaWRlIFNlZ3Vyb3NAZ3VucmE=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/607b4a3e-d4f8-5183-b47b-11c24c4a4329/pir-mide-seguros-breached-by-gunra-ransomware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup