The NightSpire ransomware group claims to have breached DataBank, a prominent financial and data solutions provider based in Nicaragua. The threat actor officially listed the organization on its dark web leak site, indicating that the initial compromise occurred on January 19, 2025. NightSpire, an extortion-focused group known for utilizing double-extortion tactics and targeting small-to-medium enterprises, has set a data publication deadline for February 5, 2026.
According to the actor, the breach resulted in the exfiltration of 48.5GB of sensitive information. The allegedly compromised data includes:
-
Internal financial records
-
Client databases and contact information
-
Confidential corporate documents
-
Employee payroll and HR records
-
Technical infrastructure documentation
